diff options
author | Toni Uhlig <matzeton@googlemail.com> | 2021-06-08 15:57:13 +0200 |
---|---|---|
committer | Toni Uhlig <matzeton@googlemail.com> | 2021-06-08 16:18:54 +0200 |
commit | 7daeee141d235b53b4b3c1b825acaf06a0cf19c9 (patch) | |
tree | 412df5e6f48aa281ed78f79ee43da911598f81af | |
parent | a41ddafa88de870aadad4acdf0193ac3a326c403 (diff) |
`make dist`
* fixed run_tests.sh file check bug, CI compat
* updated results due to libnDPI submodule update
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
-rw-r--r-- | .travis.yml | 6 | ||||
-rwxr-xr-x | scripts/get-and-build-libndpi.sh | 7 | ||||
-rwxr-xr-x | scripts/make-dist.sh | 28 | ||||
-rw-r--r-- | test/results/skype.pcap.out | 456 | ||||
-rw-r--r-- | test/results/skype_no_unknown.pcap.out | 418 | ||||
-rw-r--r-- | test/results/skype_udp.pcap.out | 4 | ||||
-rw-r--r-- | test/results/teams.pcap.out | 18 | ||||
-rwxr-xr-x | test/run_tests.sh | 15 |
8 files changed, 489 insertions, 463 deletions
diff --git a/.travis.yml b/.travis.yml index 824c2ddf0..cd401974e 100644 --- a/.travis.yml +++ b/.travis.yml @@ -14,5 +14,7 @@ script: - ./build/nDPId-test || test $? -eq 1 - ./build/nDPId -h || test $? -eq 1 # dameon start/stop test -- ./scripts/daemon.sh ./build/nDPId ./build/nDPIsrvd -- ./scripts/daemon.sh ./build/nDPId ./build/nDPIsrvd +- make -C ./build daemon +- make -C ./build daemon +# make dist +- ./scripts/make-dist.sh diff --git a/scripts/get-and-build-libndpi.sh b/scripts/get-and-build-libndpi.sh index df0ab2b2c..945dcf7b3 100755 --- a/scripts/get-and-build-libndpi.sh +++ b/scripts/get-and-build-libndpi.sh @@ -1,7 +1,6 @@ #!/usr/bin/env bash set -e -set -x LOCKFILE="$(realpath "${0}").lock" touch "${LOCKFILE}" @@ -11,8 +10,12 @@ flock -x -n 42 || { exit 1; } +set -x + cd "$(dirname "${0}")/.." -git submodule update --init ./libnDPI +if [ -d ./.git ]; then + git submodule update --init ./libnDPI +fi cd ./libnDPI DEST_INSTALL="${DEST_INSTALL:-$(realpath ./install)}" diff --git a/scripts/make-dist.sh b/scripts/make-dist.sh new file mode 100755 index 000000000..b978aeb65 --- /dev/null +++ b/scripts/make-dist.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash + +set -e + +LOCKFILE="$(realpath "${0}").lock" +touch "${LOCKFILE}" +exec 42< "${LOCKFILE}" +flock -x -n 42 || { + printf '%s\n' "Could not aquire file lock for ${0}. Already running instance?" >&2; + exit 1; +} + +cd "$(dirname "${0}")/.." +if [ ! -d ./.git ]; then + printf '%s\n' "This script can only by run from a nDPId git repository." >&2 +fi + +git submodule update --init ./libnDPI +NDPID_GIT_VERSION="$(git describe --tags)" +cd ./libnDPI && \ + LIBNDPI_GIT_VERSION="$(git describe --tags)" + git archive --prefix="nDPId-${NDPID_GIT_VERSION}/libnDPI/" -o "../libnDPI-${LIBNDPI_GIT_VERSION}.tar" HEAD && \ + cd .. +git archive --prefix="nDPId-${NDPID_GIT_VERSION}/" -o "./nDPId-${NDPID_GIT_VERSION}.tar" HEAD +tar --concatenate --file="./nDPId-${NDPID_GIT_VERSION}.tar" "./libnDPI-${LIBNDPI_GIT_VERSION}.tar" +bzip2 -9 "./nDPId-${NDPID_GIT_VERSION}.tar" + +rm -f "${LOCKFILE}" diff --git a/test/results/skype.pcap.out b/test/results/skype.pcap.out index dbb67a3d2..d67fad8d4 100644 --- a/test/results/skype.pcap.out +++ b/test/results/skype.pcap.out @@ -1,25 +1,25 @@ 00473{"daemon_event_id":1,"daemon_event_name":"init","thread_id":0,"packet_id":0,"source":"skype.pcap","alias":"nDPId-test","max-flows-per-thread":2048,"max-idle-flows-per-thread":256,"tick-resolution":1000,"reader-thread-count":1,"idle-scan-period":10000,"generic-max-idle-time":600000,"icmp-max-idle-time":30000,"udp-max-idle-time":180000,"tcp-max-idle-time":7440000,"tcp-max-post-end-flow-time":120000,"max-packets-per-flow-to-send":15,"max-packets-per-flow-to-process":255} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431969641947,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969641,"pkt_ts_usec":947863,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAt5UAAEARP6TAqAEiwKgBAcALADUALIa2zTYBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} -00647{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431969641947,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"skype.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431969641947,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49163,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"skype.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431969641948,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57406,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969641,"pkt_ts_usec":948058,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA5KYAAEAREpPAqAEiwKgBAeA+ADUALBXIHdcBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} -00648{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"skype.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431969641948,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57406,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"skype.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431969641948,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57406,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":87132,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDTB0AAEARqxnAqAEiwKgBAdmfADUAL7TEHKMBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} -00650{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00656{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"skype.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52850,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":87286,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDfx0AAEAReBnAqAEiwKgBAc5yADUAL8ad+vYBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} -00651{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"skype.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52850,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00657{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"skype.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431969642087,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52850,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"skype.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431969642244,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54396,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":244935,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7CqYAAEAR7JjAqAEiwKgBAdR8ADUAJ+nL8sABAAABAAAAAAAAA2FwaQVza3lwZQNjb20AAAEAAQ=="} -00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"skype.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431969642244,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54396,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"skype.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431969642244,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54396,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"skype.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431969642247,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65426,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":247578,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7ECYAAEAR5xjAqAEiwKgBAf+SADUAJwCOlegBAAABAAAAAAAAA2FwaQVza3lwZQNjb20AABwAAQ=="} -00644{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"skype.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431969642247,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65426,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00650{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"skype.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431969642247,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65426,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":12,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431969642318,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":12,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":318375,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"0NQSxnP1PBXCt3IOCABFAABE3usAAEARGErAqAEiwKgBAfpVADUAMOQoL9MBAAABAAAAAAAABWU3NzY4AWIKYWthbWFpZWRnZQNuZXQAAAEAAQ=="} -00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431969642318,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e7768.b.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":12,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431969642318,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e7768.b.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":13,"source":"skype.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1431969642334,"flow_last_seen":0,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":59,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58681,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00471{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":334003,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"0NQSxnP1PBXCt3IOCABFAABXAnAAAEAR9LLAqAEiwKgBAeU5ADUAQzJbSPEBAAABAAAAAAAADkRCM01TR1I1MDExNzA5B2dhdGV3YXkJbWVzc2VuZ2VyBGxpdmUDY29tAAAcAAE="} 00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":13,"source":"skype.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1431969642334,"flow_last_seen":0,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":59,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58681,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"db3msgr5011709.gateway.messenger.live.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -27,26 +27,26 @@ 00440{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":336869,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA5NNAAEAGc8HAqAEiQTffIcNqnEKAlL6TAAAAALAC\/\/\/spQAAAgQFtAEDAwUBAQgKPiKLPAAAAAAEAgAA"} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":15,"source":"skype.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":337189,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+t\/gAAEARP0PAqAEiwKgBAcKBADUAKu5ghe0BAAABAAAAAAAABGRzbjQBZAVza3lwZQNuZXQAAAEAAQ=="} -00647{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"skype.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49793,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn4.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"skype.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49793,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn4.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":16,"source":"skype.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65045,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":337316,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+EyEAAEAR5BrAqAEiwKgBAf4VADUAKsDYd8YBAAABAAAAAAAABGRzbjQBZAVza3lwZQNuZXQAABwAAQ=="} -00648{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":16,"source":"skype.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65045,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn4.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":16,"source":"skype.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431969642337,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65045,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn4.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00465{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":376469,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"PBXCt3IO0NQSxnP1CABFAABUAABAAEARtyXAqAEBwKgBIgA1+lUAQEJvL9OBgAABAAEAAAAABWU3NzY4AWIKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAAQABBffSSI="} -00677{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":17,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1431969642318,"flow_last_seen":1431969642376,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e7768.b.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.223.73.34"}} +00683{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":17,"source":"skype.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":2,"flow_first_seen":1431969642318,"flow_last_seen":1431969642376,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64085,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e7768.b.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.223.73.34"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":18,"source":"skype.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1431969642376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.223.73.34","src_port":50027,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":376823,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAw0tAAEAGVKHAqAEiF99JIsNrAbvkkjeSAAAAALAC\/\/9pYAAAAgQFtAEDAwUBAQgKPiKLYwAAAAAEAgAA"} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":19,"source":"skype.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49990,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":398350,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKxdsAAEARMVTAqAEiwKgBAcNGADUANrH\/diQBAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDYBcgVza3lwZQNuZXQAAAEAAQ=="} -00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"skype.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49990,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst6.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00665{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":19,"source":"skype.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49990,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst6.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":20,"source":"skype.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57288,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":398483,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKPqUAAEARuIrAqAEiwKgBAd\/IADUANro4UU4BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDYBcgVza3lwZQNuZXQAABwAAQ=="} -00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"skype.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57288,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst6.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00666{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":20,"source":"skype.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431969642398,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57288,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst6.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00560{"flow_id":8,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":400867,"pkt_caplen":166,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":166,"pkt_l4_len":132,"pkt":"PBXCt3IO0NQSxnP1CABFAACYAABAAEARtuHAqAEBwKgBIgA15TkAhAy4SPGBgAABAAAAAQAADkRCM01TR1I1MDExNzA5B2dhdGV3YXkJbWVzc2VuZ2VyBGxpdmUDY29tAAAcAAHALQAGAAEAAArBADUDbnMxBG1zZnQDbmV0AAZtc25oc3QJbWljcm9zb2Z0wDJ4Gz7uAAAcIAAAA4QAJOoAAAAOEA=="} 00691{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":21,"source":"skype.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":2,"flow_first_seen":1431969642334,"flow_last_seen":1431969642400,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":183,"flow_avg_l4_payload_len":91,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58681,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"db3msgr5011709.gateway.messenger.live.com","num_queries":1,"num_answers":1,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00434{"flow_id":12,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":22,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":433995,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGIPEX30kiwKgBIgG7w2sxgMP95JI3k6ASOJD6qQAAAgQFrAQCCAr301nQPiKLYwEDAwU="} 00423{"flow_id":12,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":23,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":434069,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0zNJAAEAGSybAqAEiF99JIsNrAbvkkjeTMYDD\/oAQECxRlwAAAQEICj4ii5z301nQ"} 00685{"flow_id":12,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":24,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":434817,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"0NQSxnP1PBXCt3IOCABFAADz+0lAAEAGG\/DAqAEiF99JIsNrAbvkkjeTMYDD\/oAYECz3GAAAAQEICj4ii5z301nQFgMBALoBAAC2AwNVWh9qIUBTYdqPuvpJ\/EUxWvWdVTCc6qQWuOlUPkFPXAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAQwAAABkAFwAAFGFwcHMuc2t5cGVhc3NldHMuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} -00773{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":24,"source":"skype.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_first_seen":1431969642376,"flow_last_seen":1431969642434,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":191,"flow_tot_l4_payload_len":191,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.223.73.34","src_port":50027,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skypeassets.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00779{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":24,"source":"skype.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":4,"flow_first_seen":1431969642376,"flow_last_seen":1431969642434,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":191,"flow_tot_l4_payload_len":191,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.223.73.34","src_port":50027,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skypeassets.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":25,"source":"skype.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1431969642444,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":50028,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":25,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":444382,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA1ldAAEAGhorAqAEinTh+08NsAbvs\/oHsAAAAALAC\/\/9bSwAAAgQFtAEDAwUBAQgKPiKLpgAAAAAEAgAA"} 00433{"flow_id":9,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":26,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":469363,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYZlBN98hwKgBIpxCw2oyvdjRgJS+lKASOJDQnQAAAgQFrAQCCApNl5tJPiKLPAEDAwk="} @@ -66,22 +66,22 @@ 00426{"flow_id":15,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":630945,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0anpAAEAG8nPAqAEinTh+08NsAbvs\/oJLJaFomYAQ\/\/\/YHwAAAQEICj4ijF0ZLBpv"} 02372{"flow_id":15,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":708091,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"PBXCt3IO0NQSxnP1CABFAAXUXR9AAHYGxC6dOH7TwKgBIgG7w2wloWiZ7P6CS4AQ\/SBcLgAAAQEIChksGng+IoxdUYsZAArswT+sVYDe4\/s+octFa5f5NraUxxncYJ0H1DXox59A2Fq5VISuVN85wP2CCUyU9Jri0W12MS8UHhofDtCC\/aeGWq+l6J+nD16R4eDapUlNB52CJOmfvVeyYhEr\/aSkyh+x5qntiHPmxNL4oQ4t9q9cRGg37NGw4W3v7gKUqZA7GOEtfs7ndzQKvfITYRFhRXtB+Geyc8SVWiWlBbePlt40Z9Mwm7DPu0JToThROvr07EpvaNHsDj+sfl4\/ssqhJPAoVfz0wWGwi\/ByYUJT0t+8BVptm\/HAUYoi\/0PQFRMfymq9Y999sgymNr6YwPYzcm66fQL57hVd+E\/NpGuAwv\/j4I98bfIb7cS26RkUtr41mvTduUpwXz6HZnONvg3rFQ55MtL0jpv\/5T2PNTkmAFhF5Csuvsme4bvtShQRBEmXn48raUgx6y\/5XH7Pm2hyngLVzMnjf+Ej0KsCBNhIlshCh7AABeUwggXhMIIEyaADAgECAgQHJ6pHMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTQwNTA3MTcwNDA5WhcNMTgwNTA3MTcwMzMwWjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgU1NMIFNIQTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDR6DendopwSxnwIDcJJDd\/6vt45gW6aq1OJw38cmrZbCHEZBGVcxAKXCV7iGyUBP3H26573EoIsz4W8dCt2zBt1xoeUrU98EcZA+J9pr1XEz9U6jqjsXf8QvBjSWqRgC4wScCK6yuv\/jrrB10G9+n9hA6RvQkgKehuXQnOFdPn79tQ60TvGFerBB28Mfn3eyoTz9E9Ua8bxbV757D8U7ua52PeQTO2RyRpXbhGp\/+tq99PenglJyEmNMoCbjdR8O1YGmCU9sST2N0wJCXXHOsZlDVdk7KuqimDc8R0WQVSZ53aZ1E5BTo26vIedisUruw9+RSZiwduvOcMVt6svq7bdTKQnmO9dL\/gCsr4NJZnhM3RQjh4x5m2DM62D+kby\/RZvhEOyywyyPqDKWR5PItL8DJ0bPOTuJZrXVdaaMHMDHmKGd71SQJeCIABiQwyzdLWltVLoPPsv6v0fbOhuXzaTtflt6y58iVfAcuMlqgorsEzWvY\/CJDc6\/852CbIEp0cmqqpwBaOhu1nUpYAfw2SPT3ZcDbl6kJvH66V5Vtd+NA6x9Ted4bQ\/J5O4uK4qWg3CcQ544W4ifMfbrdtH0ovGAlv3koBjxTJt6bup2OfM6RUfEKDaLil37\/suRpdEzvZrWj9IApVkSFk+dcTAaAIXVmJG0SvpKzHBRD6QUqo+wIDAQABo4IBezCCAXcwEgYDVR0TAQH\/BAgwBgEB\/wIBADBgBgNVHSAEWTBXMEgGCSsGAQQBsT4BADA7MDkGCCsGAQUFBwIBFi1odHRwOi8vY3liZXJ0cnVzdC5vbW5pcm9vdC5jb20vcmVwb3NpdG9yeS5jZm0wCwYJKwYBBAGCNyoBMEIGCCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAYYmaHR0cDovL29jc3Aub21uaXJvb3QuY29tL2JhbHRpbW9yZXJvb3QwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUF"} 01505{"flow_id":15,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":41,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":708318,"pkt_caplen":864,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":864,"pkt_l4_len":830,"pkt":"PBXCt3IO0NQSxnP1CABFAANSXSBAAHYGxq+dOH7TwKgBIgG7w2wloW457P6CS4AY\/SCFTgAAAQEIChksGng+IoxdBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NkcDEucHVibGljLXRydXN0LmNvbS9DUkwvT21uaXJvb3QyMDI1LmNybDAdBgNVHQ4EFgQUUa8kJpz0aCJXgCYrO0ZiFXsezKUwDQYJKoZIhvcNAQELBQADggEBAGli9oSRAMRvgnsk4UKipYuCXKfFRMvnUnZj03aeeOJpNbE4urCWxh+se8ayZXeLfY2uZLmljBfKWGXDrYL1xaL1AROTxn5E5cRh+gO2VsFy4cgoxWkhj6xu\/X9Dgza4wNagKP4aRb79k4yNpGR5HxTboZ8h3MBOexciF7G2PNOb4gqjfpmwwazY9IbfPNp9FJxAwXzSGG\/xTyZFCZWUXNrQmPj0TIKWEN6sMMsrrvmS6r95A\/weP6wJpD9l\/ZFPliSnzrROapYpF67AqN8XIvQX49wcOQZWEOrqtXQXPE7dfpEKqAt4B6cxRAgxqxiEDxKc596ELOltk0W\/qME\/NNwMAAFnAwAYYQTTN3+FNDwR9eQeYOtvGQZc+LyhevxS5+nlWdkwyQdoN8m1+2TrSW23TxxjbLbMZoXA+i+E6BgARpsJXZy4miOppb32qv9x1t203eD1ERk7k5Ne4\/vHdrClQby6SNFwJX8BAATxuL0lrQIrFkTOmrS5j4SkOHuGFL5IcHjsIYlkHJlCypJxNDdccJhYLSmDWKENgzEzPLuBRlhOVXExXlaXjd68azcrncuOeSNLeJs78eJnyzYwueBV344\/vv\/bXNO4NZWFimC\/F4mVSiKEMCm7MyjsWpHZmcyKExChenvC0DW6ATJpMz1P4puTiXvc\/8vEV+pCUBOhRwLMvD9W3q3uRUvG3vg3vVjajv+Btk1AKLdhZaRe4JLk95s\/SEkzGRiWE3FMms62iGDeJkFoWMbc9BW\/F7T0cbGYU\/g91JLgrFBNmNc8lbhf\/w7YDwyAohQfhUNLqcaoLYvKXuoozmjbQcIOAAAA"} -01195{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"skype.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":9,"flow_first_seen":1431969642444,"flow_last_seen":1431969642708,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3792,"flow_avg_l4_payload_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":50028,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.gateway.messenger.live.com,*.beta.gateway.edge.messenger.live.com,*.by2.gateway.edge.messenger.live.com,*.sn1.gateway.edge.messenger.live.com","ja3":"06207a1730b5deeb207b0556e102ded2","ja3s":"5e4e5596180ebd0ac0317125ee490707","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2","issuerDN":"CN=*.gateway.messenger.live.com","fingerprint":"95:C4:07:41:85:D4:EF:AA:D9:1F:0F:1F:3C:08:BF:8E:8B:D0:90:51"}} +01201{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":41,"source":"skype.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":9,"flow_first_seen":1431969642444,"flow_last_seen":1431969642708,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3792,"flow_avg_l4_payload_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":50028,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.gateway.messenger.live.com,*.beta.gateway.edge.messenger.live.com,*.by2.gateway.edge.messenger.live.com,*.sn1.gateway.edge.messenger.live.com","ja3":"06207a1730b5deeb207b0556e102ded2","ja3s":"5e4e5596180ebd0ac0317125ee490707","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2","issuerDN":"CN=*.gateway.messenger.live.com","fingerprint":"95:C4:07:41:85:D4:EF:AA:D9:1F:0F:1F:3C:08:BF:8E:8B:D0:90:51"}} 00427{"flow_id":15,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":708360,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA08wdAAEAGaebAqAEinTh+08NsAbvs\/oJLJaFxV4AQ\/\/\/PCwAAAQEICj4ijKoZLBp4"} 00575{"flow_id":15,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":721022,"pkt_caplen":173,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":173,"pkt_l4_len":139,"pkt":"0NQSxnP1PBXCt3IOCABFAACfLVVAAEAGLy7AqAEinTh+08NsAbvs\/oJLJaFxV4AY\/\/8rtQAAAQEICj4ijLYZLBp4FgMBAGYQAABiYQSjw7rH0spJ7j8GLYCMheRZGMxZ3\/fgvwjIxHOMZDyj1laQGsIe8lJQFXSsShMnTlSuvrtrEr4fnpODoiXtT2hGPxMrjRFBdsir\/yXczKkdYM+WfvMDNhZibmcCg77lKAQ="} 00685{"flow_id":12,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":811199,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"0NQSxnP1PBXCt3IOCABFAADz0jBAAEAGRQnAqAEiF99JIsNrAbvkkjeTMYDD\/oAZECz1pAAAAQEICj4ijQ\/301nQFgMBALoBAAC2AwNVWh9qIUBTYdqPuvpJ\/EUxWvWdVTCc6qQWuOlUPkFPXAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAQwAAABkAFwAAFGFwcHMuc2t5cGVhc3NldHMuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":45,"source":"skype.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431969642969,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49903,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00430{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":45,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969642,"pkt_ts_usec":969264,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6a7MAAEARi4zAqAEiwKgBAcLvADUAJlJY1+QBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} -00643{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"skype.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431969642969,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49903,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00649{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":45,"source":"skype.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431969642969,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49903,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00422{"flow_id":15,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":46,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":9186,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0ZFRAAHYGwpmdOH7TwKgBIgG7w2wloXFX7P6CtoAQ\/LXRwAAAAQEIChksGpY+Ioy2"} 00508{"flow_id":15,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":47,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":9234,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":125,"pkt_l4_len":91,"pkt":"0NQSxnP1PBXCt3IOCABFAABvm8pAAEAGwOjAqAEinTh+08NsAbvs\/oK2JaFxV4AY\/\/\/bRAAAAQEICj4ijdQZLBqWFAMBAAEBFgMBADDh1P2DFckZhZIzor4Rd7jotjMfxJZ2UzpT6K+Q5gEAtsfbN\/CWzx7cD1P81jQ1G+s="} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":48,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431969643037,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":37502,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"0NQSxnP1PBXCt3IOCABFAABEXycAAEARmA7AqAEiwKgBAcqnADUAMDQMD6ABAAABAAAAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAQ=="} -00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":48,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431969643037,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":48,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431969643037,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00436{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":44621,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAjuUAAEARaFTAqAEiwKgBAcALADUALIa2zTYBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} 00436{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":44901,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAZzYAAEARkAPAqAEiwKgBAeA+ADUALBXIHdcBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} 00465{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":51,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":92602,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"PBXCt3IO0NQSxnP1CABFAABUAABAAEARtyXAqAEBwKgBIgA1yqcAQLnbD6CBgAABAAEAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAAgABBfOIaY="} -00679{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":51,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431969643037,"flow_last_seen":1431969643092,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} +00685{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":51,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431969643037,"flow_last_seen":1431969643092,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} 00509{"flow_id":15,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":92605,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":125,"pkt_l4_len":91,"pkt":"PBXCt3IO0NQSxnP1CABFAABvZhBAAHYGwKKdOH7TwKgBIgG7w2wloXFX7P6C8YAY\/HoykQAAAQEIChksGp0+Io3UFAMBAAEBFgMBADAEIZ9QnHrxVn\/WY8oun0Tyt3xxzcNsOk\/T+WDRxQ8\/8kzjS7L\/TKzBpAcOCtF1Dsw="} 00426{"flow_id":15,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":92714,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0EOJAAEAGTAzAqAEinTh+08NsAbvs\/oLxJaFxkoAQ\/\/\/MiAAAAQEICj4ijicZLBqd"} 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":55,"source":"skype.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1431969643093,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50029,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -90,7 +90,7 @@ 00434{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":57,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":139721,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADkGRn4XziGmwKgBIgG7w20Yoc3insF6bqASOJBNnAAAAgQFrAQCCArsLkk6PiKOJwEDAwU="} 00422{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":139799,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0z0xAAEAGcDnAqAEiF84hpsNtAbuewXpuGKHN44AQECyklQAAAQEICj4ijlTsLkk6"} 00675{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":140579,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtyndAAEAGdFXAqAEiF84hpsNtAbuewXpuGKHN44AYECz6mwAAAQEICj4ijlXsLkk6FgMBALQBAACwAwNVWh9r1BitCFD8cZbUoP0jV12FHPzKsJViTeYgJXwI\/wAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} -00768{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":59,"source":"skype.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1431969643093,"flow_last_seen":1431969643140,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50029,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skype.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00774{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":59,"source":"skype.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1431969643093,"flow_last_seen":1431969643140,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50029,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skype.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00442{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":63,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":186457,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDNYcAAEARwa\/AqAEiwKgBAdmfADUAL7TEHKMBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} 00441{"flow_id":4,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":64,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":186535,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABD3H8AAEARGrfAqAEiwKgBAc5yADUAL8ad+vYBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} 00433{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":68,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":343162,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7eVIAAEARfezAqAEiwKgBAdR8ADUAJ+nL8sABAAABAAAAAAAAA2FwaQVza3lwZQNjb20AAAEAAQ=="} @@ -106,10 +106,10 @@ 00676{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":110,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":954910,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtWwFAAEAG48vAqAEiF84hpsNtAbuewXpuGKHN44AYECz3dgAAAQEICj4ikXrsLkk6FgMBALQBAACwAwNVWh9r1BitCFD8cZbUoP0jV12FHPzKsJViTeYgJXwI\/wAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":112,"source":"skype.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431969643971,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60288,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":112,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":971809,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLW5oAAEARm5TAqAEiwKgBAeuAADUAN9PqYyoBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAABAAE="} -00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":112,"source":"skype.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431969643971,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60288,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":112,"source":"skype.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431969643971,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60288,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":113,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431969643972,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":113,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969643,"pkt_ts_usec":972025,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLe5YAAEARe5jAqAEiwKgBAeF+ADUAN7bIb04BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} -00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431969643972,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":113,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431969643972,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00433{"flow_id":9,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":115,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969644,"pkt_ts_usec":2391,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8sH5AAEAGqBrAqAEiQTffIcNqnEKAlL7NMr3ZNIAYECi8awAAAQEICj4ikahNl5tsq7xG5CK7Tso="} 00430{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":125,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969644,"pkt_ts_usec":54609,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6xBwAAEARMyPAqAEiwKgBAcLvADUAJlJY1+QBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} 00437{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":126,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969644,"pkt_ts_usec":55126,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAXA0AAEARmyzAqAEiwKgBAcALADUALIa2zTYBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} @@ -190,69 +190,69 @@ 00455{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":499,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969652,"pkt_ts_usec":269113,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLQawAAEARtYLAqAEiwKgBAeF+ADUAN7bIb04BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":500,"source":"skype.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1431969652367,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":24,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":500,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969652,"pkt_ts_usec":367075,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+qlYAAEARtuTAqAEiQAQXpjLdnFYAKjPsm5AC0vz7eA6m1WQz3XSdSXIE0xPsZ0Mgdb244ufZVMBp9g=="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":500,"source":"skype.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1431969652367,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":500,"source":"skype.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":1,"flow_first_seen":1431969652367,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00686{"flow_id":12,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":502,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":119942,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"0NQSxnP1PBXCt3IOCABFAADzP99AAEAG11rAqAEiF99JIsNrAbvkkjeTMYDD\/oAZECzNsAAAAQEICj4itQP301nQFgMBALoBAAC2AwNVWh9qIUBTYdqPuvpJ\/EUxWvWdVTCc6qQWuOlUPkFPXAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAQwAAABkAFwAAFGFwcHMuc2t5cGVhc3NldHMuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":503,"source":"skype.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":25,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":503,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":376411,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4KG4AAEARcKrAqAEinTeCmzLdnFQAJDcMm5ICyNK5iZjkkcxv0MQR2rwmgaeyTFibCj82iA=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":503,"source":"skype.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":503,"source":"skype.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":504,"source":"skype.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":504,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":376411,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6eUkAAEARgjTAqAEib91NjjLdnFcAJt55m5QCPbPKJuLeDOim50Iw20p93HTUvcQYvwIjUtlP"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":504,"source":"skype.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":504,"source":"skype.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":505,"source":"skype.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":27,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":505,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":376578,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/jgcAAEARcPDAqAEib91KDzLdnFgAK3qlm5YCVGMQ34A4D4rgbT25j64U\/rdJx+5zd3Em6+QXhoxyxA8="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":505,"source":"skype.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":505,"source":"skype.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":506,"source":"skype.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":28,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":506,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":376578,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5a+4AAEARkvDAqAEib91KLjLdnFsAJRNlm5gCrA8YBMpkQAilpoWSkSOFSSJ7mpap5i7P8hQ="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":506,"source":"skype.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":506,"source":"skype.pcap","alias":"nDPId-test","flow_id":28,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":507,"source":"skype.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":29,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":507,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":376578,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0K\/cAAEARbLHAqAEiQTffDzLdnFoAIDycm5oCpFKxpTcQMqT3s1qudFIeHwatW0Yo"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":507,"source":"skype.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":507,"source":"skype.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":1,"flow_first_seen":1431969653376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00435{"flow_id":9,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":508,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969653,"pkt_ts_usec":798202,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8cW5AAEAG5yrAqAEiQTffIcNqnEKAlL7NMr3ZNIAYECiWawAAAQEICj4it6hNl5tsq7xG5CK7Tso="} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":509,"source":"skype.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40028,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":30,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":509,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969654,"pkt_ts_usec":389094,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2YJcAAEARmtjAqAEib91NoDLdnFwAInstm5wC0d61W0FRabgFV8W1nkBP2OEpO4vgeHY="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"skype.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":509,"source":"skype.pcap","alias":"nDPId-test","flow_id":30,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":510,"source":"skype.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":31,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":510,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969654,"pkt_ts_usec":389095,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAYWsAAEARhiPAqAEinTg0HDLdnEkALM83m54CE+gbUNd25CDT9n3foWmJBdcqOFnduxapZrLe74dYiza3"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":510,"source":"skype.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":510,"source":"skype.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":511,"source":"skype.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":32,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":511,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969654,"pkt_ts_usec":389222,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAwK8AAEARb0vAqAEinTfrsDLdnFYALGUnm6AC1ZExgfTg8R8Kk2ngcBhiodhOGddomI+8IvUKr50t+FQG"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":511,"source":"skype.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":511,"source":"skype.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":512,"source":"skype.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":512,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969654,"pkt_ts_usec":389223,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2ttcAAEARMM7AqAEinTg0DzLdnFsAIgnVm6IClklzvpwg0J9RRu2barB5pBf+dP\/198s="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":512,"source":"skype.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":512,"source":"skype.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":513,"source":"skype.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":513,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969654,"pkt_ts_usec":389223,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6uggAAEARpzfAqAEiQAQXpTLdnFQAJvWzm6QCh3CXl6XGrqArz4Fq72vdiruIePdvscfnf8nL"} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":513,"source":"skype.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":513,"source":"skype.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431969654389,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":515,"source":"skype.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":515,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969655,"pkt_ts_usec":399908,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+KmIAAEARBSXAqAEi1cezljLdnEQAKk92m6YCxHNRXNt6saUbXJuaVxAVloiUB3Kd06UQ7eXoZ8Yw\/Q=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":515,"source":"skype.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":515,"source":"skype.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":516,"source":"skype.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":516,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969655,"pkt_ts_usec":399908,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAysnAAAEARTIvAqAEib91KGDLdnEEAHsG9m6gCfNYVHSc6jWjicVy5t1mw5NpUpQ=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":516,"source":"skype.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":516,"source":"skype.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431969655399,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":517,"source":"skype.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":13021,"dst_port":40008,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969655,"pkt_ts_usec":400081,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9FyIAAEAR57bAqAEib91KMDLdnEgAKadmm6oC656jqkVeUmOjjlOF7oTonkHhDKTP6NWeDWkwfWY5"} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"skype.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"skype.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":518,"source":"skype.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969655,"pkt_ts_usec":400081,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4PBwAAEARwsfAqAEib91KKjLdnFgAJKhzm6wCYALzkzdu\/LrNPcT4NWmc+JYpVJ3L9m5YbQ=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"skype.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"skype.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":519,"source":"skype.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969655,"pkt_ts_usec":400081,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1xDsAAEARa1jAqAEi1cezkjLdgQkAIXwbm64C\/E7GKHTAnqTXhScHNyy9JU+1q7MSwg=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"skype.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"skype.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431969655400,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":533,"source":"skype.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":533,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":410462,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8yZkAAEARz2bAqAEinTeCrzLdnEYAKHoim7AC0Uz4eUhtRx+U2n96ruKge0mKrTm6r7jfF82JDy4="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":533,"source":"skype.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":533,"source":"skype.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":534,"source":"skype.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.162","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":534,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":410539,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+lOIAAEARTinAqAEinTc4ojLdnEQAKlJUm7IC63nFT7uUV5k0L358bPvax6aIijF38KySzDuXwNYHgA=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":534,"source":"skype.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.162","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":534,"source":"skype.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.162","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":535,"source":"skype.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":535,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":410539,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA43x4AAEARCHPAqAEinTg0ITLdnEsAJM3am7QChNdFtOWmIsBdiMlrk7loIt\/AHz17BjRqJg=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":535,"source":"skype.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":535,"source":"skype.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":536,"source":"skype.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.172","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":536,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":410553,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAA\/QAAEAR92XAqAEib91NrDLdnEoALEKJm7YClKE3lTfT0DUQisSOS4KG\/La+hJBP5DfxaCwxffHTvFZU"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":536,"source":"skype.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.172","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":536,"source":"skype.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.172","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":537,"source":"skype.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":537,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":410568,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1zB8AAEARzPbAqAEinTeCoDLdnF0AIXcUm7gCbIFVwo6Azkv+1yCNquXcTTuKbOiUHg=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":537,"source":"skype.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":537,"source":"skype.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431969656410,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":539,"source":"skype.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1431969656652,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01080{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":539,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969656,"pkt_ts_usec":652360,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"\/\/\/\/\/\/\/\/PBXCt3IOCABFAAISRnsAAEARcJbAqAEi\/\/\/\/\/0RcRFwB\/vqceyJob3N0X2ludCI6IDE1NzMxOTU0NDUsICJ2ZXJzaW9uIjogWzEsIDhdLCAiZGlzcGxheW5hbWUiOiAiIiwgInBvcnQiOiAxNzUwMCwgIm5hbWVzcGFjZXMiOiBbMTQ4MTkzMzcsIDE3NjA5OTYzLCAyMDY0OTM0OSwgMjg1MjE2MDcsIDU4MzQ0OTk2LCA2MDU5NDk4MywgNjQ0MzYwOTksIDk2ODUzMjI0LCA5OTQ2OTc3MywgMTAxMDQ3OTk2LCAxMDgxNTkxMDIsIDEyNTU0MDU2NiwgMTc2OTY0MzA3LCAyNDM2ODI5ODYsIDI0NzkyNTA4NSwgMjYwNDY1MjYxLCAyNzA0MDQ3NDIsIDI4Mzg2MTQ1NywgNDI0NTQwMTk3LCA0NDgzOTczOTMsIDQ1MTQ3MjY1OCwgNTExNzA2NjQyLCA1NjgzOTU4MzMsIDU5NDI0Njk1NCwgNTk4MDYxMDY2LCA2MTU5ODMzNzksIDcyMDA1ODM2MSwgNzM1MDUxODMwLCA3MzYzNDE1MjgsIDc0MTI1NTYxMywgNzc2MDg3MjQ3LCA3ODA4NzA1ODEsIDc4Mjk4MTk0OSwgNzg1MjY2MTc3LCA4MTg3NTI3MTAsIDg1NTY4MjM5MCwgODg0MTIwMTMyLCA5MDg5MTQ4NjhdfQ=="} 00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":539,"source":"skype.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1431969656652,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -273,19 +273,19 @@ 00442{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":367809,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAwhRAAEAGlxXAqAEinTeCjMNynGH\/hzWiAAAAALAC\/\/+8tgAAAgQFtAEDAwUBAQgKPiLFlwAAAAAEAgAA"} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":546,"source":"skype.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":367969,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/NlsAAEARxRrAqAEib91NkTLdnFsAK6mBm7oCyq7Iy7cmxwvThWDRoZOMl0+28C1BuPbRnMjSw2j4JUc="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":546,"source":"skype.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":546,"source":"skype.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":547,"source":"skype.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":367969,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA27UQAAEARdBjAqAEiQAQXjDLdnEwAIlR2m7wC9vRcAIihDfXYF+Nv6Z8h\/1gxupEorwc="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":547,"source":"skype.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":547,"source":"skype.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":548,"source":"skype.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":548,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":367982,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4fm8AAEAR4uHAqAEiQAQXljLdnEQAJKG2m74ChlnucS6od9D4320Ts5x3xY96lsRHLX7REg=="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":548,"source":"skype.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":548,"source":"skype.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431969657367,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.150","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":549,"source":"skype.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":55,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":549,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":368015,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0lqwAAEARaEzAqAEib91KGTLdnFwAIDPbm8ACFZDv7jAw6LF020D2sIW\/RLlBE6QH"} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":549,"source":"skype.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":549,"source":"skype.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":550,"source":"skype.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.153","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":56,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":550,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":368032,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5GS4AAEAR4kXAqAEib91NmTLdnFgAJQIPm8ICkS16B313b791pcC\/iQ60uf4KWNmYdYf5eCQ="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":550,"source":"skype.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.153","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":550,"source":"skype.pcap","alias":"nDPId-test","flow_id":56,"flow_packet_id":1,"flow_first_seen":1431969657368,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.153","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00423{"flow_id":9,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":551,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":421051,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0EVBAAEAGR1HAqAEiQTffIcNqnEKAlL7VMr3ZNIARECjsdAAAAQEICj4ixcxNl5ts"} 00424{"flow_id":19,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":552,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":421113,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0H49AAEAGORLAqAEiQTffIcNuAbtcUOSfLmGB64ARECzffQAAAQEICj4ixcxNl50C"} 00436{"flow_id":51,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":553,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969657,"pkt_ts_usec":498063,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYi6dN4KMwKgBIpxhw3JnDsNv\/4c1o6ASOJAm+AAAAgQFrAQCCApOvfTqPiLFlwEDAwk="} @@ -316,19 +316,19 @@ 00441{"flow_id":57,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":580,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376019,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAQSRAAEAGrlLAqAEi1cezr8NznFXnJeTHAAAAALAC\/\/+4YAAAAgQFtAEDAwUBAQgKPiLJgQAAAAAEAgAA"} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":581,"source":"skype.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":58,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":581,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376335,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0QmIAAEARVi\/AqAEiQTffJjLdnE8AIJ1Im8QCCqRVDPPz90033q\/EDoSNqvvC54ua"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":581,"source":"skype.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":581,"source":"skype.pcap","alias":"nDPId-test","flow_id":58,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":582,"source":"skype.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40008,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":59,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":582,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376365,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+eZEAAEARtmzAqAEinTfrrzLdnEgAKiUSm8YCMvX5DXLyjY07d4zs9r3Rfjeqbt6RlQe5nLyOBDZmjA=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":582,"source":"skype.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":582,"source":"skype.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":583,"source":"skype.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":60,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":583,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376366,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+H6wAAEAReNbAqAEiQTffKzLdnEIAKjdVm8gCRata2g4WRHPEL7\/NhH8e4p0ZaFQg5mWNPjrWv1AvJA=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":583,"source":"skype.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":583,"source":"skype.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":584,"source":"skype.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":61,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":584,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376488,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4T0EAAEARk9HAqAEinTc4oTLdnEwAJGHem8oC2K8VAwXZ2I4FcvndU1pGdzS9eSLWH0xc+w=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":584,"source":"skype.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":584,"source":"skype.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":585,"source":"skype.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":62,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":585,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":376526,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4VhMAAEARqOnAqAEib91KETLdnFYAJFy+m8wCfUg82Gg6DnsozSUd0tlDoiZPS7EFljPm7g=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":585,"source":"skype.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":585,"source":"skype.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431969658376,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":57,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":586,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":463921,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADgG93rVx7OvwKgBIpxVw3Nt\/WNx5yXkyKASOJA3OAAAAgQFrAQCCApO2zlGPiLJgQEDAwk="} 00423{"flow_id":57,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":587,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":464004,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0kRFAAEAGXnHAqAEi1cezr8NznFXnJeTIbf1jcoAQECyOCgAAAQEICj4iydlO2zlG"} 00490{"flow_id":57,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":588,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969658,"pkt_ts_usec":464553,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":114,"pkt_l4_len":80,"pkt":"0NQSxnP1PBXCt3IOCABFAABkvFZAAEAGMvzAqAEi1cezr8NznFXnJeTIbf1jcoAYECzdMwAAAQEICj4iydlO2zlGUyU7cFcUPq3639jExXXe2rp6QwLRh9WNc6p+6woeVCkt2aXhyDUzLR\/RObUkbNHR"} @@ -364,19 +364,19 @@ 00438{"flow_id":2,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":616,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":272095,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAB8QAAEAR73XAqAEiwKgBAeA+ADUALBXIHdcBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":617,"source":"skype.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":66,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":617,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":392250,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3kJUAAEARCA3AqAEiQTffEjLdgQkAIzBxm84CB+tg2yEaM9\/bL8TBCQEYokW3ou6uIFeA"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":617,"source":"skype.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":617,"source":"skype.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":618,"source":"skype.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":67,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":392251,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBYQoAAEAROAbAqAEinTeCmjLdnEUALTFnm9ACrELw0MyN5alTGXUohI4skjQwNKD1mI1L+u5IA2eq73xPAw=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":618,"source":"skype.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40005,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":618,"source":"skype.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40005,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":619,"source":"skype.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":68,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":619,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":392325,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5DEcAAEARjD7AqAEiQTffLTLdnEwAJedsm9ICSKWpAVcx8I7JZ8adPdtcTNxD1Y7ygdStLzI="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":619,"source":"skype.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":619,"source":"skype.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":620,"source":"skype.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":69,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":392325,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyadkAAEARfcfAqAEinTg0GDLdnEEAHr+2m9QCPz6lPkIa5+HaiHK3kAac8KWOvw=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":620,"source":"skype.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":620,"source":"skype.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":621,"source":"skype.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":70,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":621,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":392326,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1BWcAAEAR4iHAqAEinTg0LTLdnEwAIdjym9YCeMy7FyJwEm6ud1zY3LUeAZMSqKDeqQ=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":621,"source":"skype.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":621,"source":"skype.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431969659392,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.45","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":63,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":622,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":400916,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0rp5AADMGBfedODQswKgBIgG7w3TcDZ\/UgMbzw4AQAB2lWgAAAQEICkxkMUs+Isyo"} 00490{"flow_id":63,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":623,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":401033,"pkt_caplen":112,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":112,"pkt_l4_len":78,"pkt":"0NQSxnP1PBXCt3IOCABFAABimbtAAEAGDazAqAEinTg0LMN0AbuAxvPD3A2f1IAYECwISQAAAQEICj4izXpMZDFLCID\/ssOnhCQbPdgraKv5X6X6LEBl4VvsbMI2yvwLdbH5FbeEibgiwFjV2Yetww=="} 00443{"flow_id":3,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":624,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969659,"pkt_ts_usec":426587,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDMrcAAEARxH\/AqAEiwKgBAdmfADUAL7TEHKMBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} @@ -441,19 +441,19 @@ 00436{"flow_id":49,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":645,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":325223,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8TkFAAEAGWUzAqAEinTg0LMNwnGCx3l+sHyRlkIAYECljpwAAAQEICj4i0RRMZC+5IVzDseW9I30="} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":646,"source":"skype.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":72,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":646,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":403887,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4bnAAAEARKjLAqAEiQTffETLdnFYAJDJym9gCRkbR2cp0xkwlV8oyn8X0NKXbrbkoGiloQw=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":646,"source":"skype.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":646,"source":"skype.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":647,"source":"skype.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":73,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":647,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":403888,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4jIYAAEAR1MHAqAEiQAQXnzLdnEkAJMXJm9oCsTdSNq2fp4IomM1W0LtS\/XasnVb1cYIFcA=="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":647,"source":"skype.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":647,"source":"skype.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":648,"source":"skype.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.142","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":74,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":648,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":403961,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA496cAAEAROH3AqAEinTfrjjLdnFkAJNtLm9wCCq\/Vr9SUD4fwmmEiNdezuQ9niYUSk+YjJQ=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":648,"source":"skype.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.142","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":648,"source":"skype.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.142","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":649,"source":"skype.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":75,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":649,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":403961,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3fJEAAEARs5PAqAEinTfrjzLdnF4AIz7Dm94CUldClJ3Jj\/ar7UJqBheNPI8TcYWyskFm"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":649,"source":"skype.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":649,"source":"skype.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":650,"source":"skype.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.21","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":76,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":650,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":403962,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAy3tIAAEARCNHAqAEinTg0FTLdnEQAHrtxm+ACoNYW9c0Iu96VtPV4yMd9SlxQuA=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":650,"source":"skype.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.21","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":650,"source":"skype.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431969660403,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.21","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00494{"flow_id":71,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":651,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":484584,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"0NQSxnP1PBXCt3IOCABFAABmD4lAAEAG38fAqAEi1cezr8N3AbvoukrF6jj3F4AYECxe5QAAAQEICj4i0bNO2zrq3Ik+3JoryHORYpUOodhZtdvbaLVaOrSVdhFGDoNFz\/ygR9NCUBkcRkZjFi6mIQWuXX4="} 00437{"flow_id":51,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":652,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":537735,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA80ZBAAEAGh53AqAEinTeCjMNynGH\/hzYDZw7DuIAYECnYWgAAAQEICj4i0ehOvfULJJFwCjegzGQ="} 00456{"flow_id":65,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":653,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969660,"pkt_ts_usec":630996,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMISNAAEAGN\/vAqAEinTeCjMN2AbvInJlHrpWZfIAYECxeqwAAAQEICj4i0kROvfadOsfzaffo90GU9fGuBRpgbZPEZs9Bzxti"} @@ -467,38 +467,38 @@ 00455{"flow_id":21,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":661,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":362113,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLuWoAAEARPcTAqAEiwKgBAeF+ADUAN7bIb04BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":662,"source":"skype.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":77,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":662,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":414015,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+WsgAAEARoKjAqAEib91NlzLdnFsAKnZMm+IChMIMA7Iu2mZsqQZJnqfJooyOMKE\/uWGoix8bU\/YAAA=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":662,"source":"skype.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":662,"source":"skype.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":663,"source":"skype.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":78,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":663,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":414016,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/HyoAAEARyHDAqAEinTg0ETLdnE0AK6EGm+QCNgMH2ITpxVJW+XmKXJHtTvzd6uYJCxFPw1m4ZheLNng="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":663,"source":"skype.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":663,"source":"skype.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":664,"source":"skype.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":79,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":664,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":414088,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2iHEAAEAR2M3AqAEiQAQXqjLdnEsAIkoGm+YCpGAFhs2RBCMUexQexYbsFkqmQ\/8Qtyc="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":664,"source":"skype.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":664,"source":"skype.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":665,"source":"skype.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.168","src_port":13021,"dst_port":40007,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":80,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":665,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":414088,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2+lgAAEARAQ\/AqAEib91NqDLdnEcAIop9m+gChrJ8v\/omTh7Ne4Bar5T53RvLKUpGcwE="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":665,"source":"skype.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.168","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":665,"source":"skype.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.168","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":666,"source":"skype.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":81,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":666,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":414088,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5wkwAAEARPJTAqAEib91KLDLdnF8AJV5Dm+oCagLaZIeW7H9EIxc7czPbdaN+lYkEZAqCu0Q="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":666,"source":"skype.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":666,"source":"skype.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":1,"flow_first_seen":1431969661414,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00686{"flow_id":12,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":669,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":537143,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"0NQSxnP1PBXCt3IOCABFAADzbXJAAEAGqcfAqAEiF99JIsNrAbvkkjeTMYDD\/oAZECys5wAAAQEICj4i1cz301nQFgMBALoBAAC2AwNVWh9qIUBTYdqPuvpJ\/EUxWvWdVTCc6qQWuOlUPkFPXAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAQwAAABkAFwAAFGFwcHMuc2t5cGVhc3NldHMuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00494{"flow_id":71,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":670,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":868514,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"0NQSxnP1PBXCt3IOCABFAABmO61AAEAGs6PAqAEi1cezr8N3AbvoukrF6jj3F4AYECxZgQAAAQEICj4i1xdO2zrq3Ik+3JoryHORYpUOodhZtdvbaLVaOrSVdhFGDoNFz\/ygR9NCUBkcRkZjFi6mIQWuXX4="} 00490{"flow_id":63,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":671,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969661,"pkt_ts_usec":889665,"pkt_caplen":112,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":112,"pkt_l4_len":78,"pkt":"0NQSxnP1PBXCt3IOCABFAABinkRAAEAGCSPAqAEinTg0LMN0AbuAxvPD3A2f1IAYECz+lgAAAQEICj4i1yxMZDFLCID\/ssOnhCQbPdgraKv5X6X6LEBl4VvsbMI2yvwLdbH5FbeEibgiwFjV2Yetww=="} 00455{"flow_id":65,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":673,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":150768,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABM+VNAAEAGX8rAqAEinTeCjMN2AbvInJlHrpWZfIAYECxYvgAAAQEICj4i2DFOvfadOsfzaffo90GU9fGuBRpgbZPEZs9Bzxti"} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":674,"source":"skype.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":82,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":674,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":422043,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBe8QAAEARtE3AqAEinTfrmDLdnEEALXlam+wCJAhMYE3a2mA+K8Gsvq1dkqSohtdF5WONseMrsTgQWNCbqg=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":674,"source":"skype.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":674,"source":"skype.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":675,"source":"skype.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":83,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":675,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":422044,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0PtsAAEAR8UnAqAEinTfrkjLdgQkAINq8m+4CkuZLUb2HgW9IroWQ+JaU9ew2O1bn"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":675,"source":"skype.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":675,"source":"skype.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":676,"source":"skype.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":84,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":676,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":422217,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/GQkAAEARSEjAqAEiQAQXjzLdnFIAK+Dtm\/ACn46vTpwjXGMZ9bJtrKD0Tox8o\/uW9MNcEfVIZROhfxw="} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":676,"source":"skype.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":676,"source":"skype.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":677,"source":"skype.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":85,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":677,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":422217,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+3+IAAEARuLHAqAEiQTffGTLdnFwAKrqUm\/ICs3eZ5yAavzTYAFVG6cHtvks6WRTX6quz\/un4rGT7CA=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":677,"source":"skype.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":677,"source":"skype.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.25","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":678,"source":"skype.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":86,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":678,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":422217,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/8JUAAEAR8n\/AqAEinTc4lzLdnFsAK42nm\/QCY347bApK+fSJyR3vpMK2pFmarm3qJcKY67tEOMSW2tE="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":678,"source":"skype.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":678,"source":"skype.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431969662422,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.151","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00523{"flow_id":64,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":679,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":484047,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"0NQSxnP1PBXCt3IOCABFAAB6QTZAAEAGYZzAqAEinTc4qsN1AbtlArNVviBnW4AYECzm9wAAAQEICj4i2X5Nea82lrtEvF7Syi3sYudbWmm1LLmltdXITy9EZvRGZ4\/xmZ+XSmldmKNIhY33FGOH7bkZm8kH56oaXL6ossqblsc6QCTpmqw22A=="} 00436{"flow_id":49,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":680,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":651193,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8iUBAAEAGHk3AqAEinTg0LMNwnGCx3l+sHyRlkIAYEClalgAAAQEICj4i2iVMZC+5IVzDseW9I30="} 00437{"flow_id":57,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":681,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969662,"pkt_ts_usec":966374,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8gFdAAEAGbyPAqAEi1cezr8NznFXnJeT4bf1jqoAYECrYhwAAAQEICj4i22BO2zlegPUYPB\/96j4="} @@ -508,19 +508,19 @@ 00441{"flow_id":87,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":685,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":377930,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA1DJAAEAGhNzAqAEinTeCp8N8nF+W1hb6AAAAALAC\/\/8sigAAAgQFtAEDAwUBAQgKPiLc+gAAAAAEAgAA"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":686,"source":"skype.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":88,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":686,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":378172,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAy1ywAAEARC+fAqAEinTc4pjLdnFYAHmpym\/YCUIZT7d8ZZahDgzlHGwrFeQgMHw=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":686,"source":"skype.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":686,"source":"skype.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.166","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":687,"source":"skype.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":89,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":687,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":378172,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBojAAAEARjU7AqAEi1cezmzLdnEQALVYJm\/gCocGAOu9ctMRuZg09sIXFBXfoFp0ezBOePl8z3klTgDOO8A=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":687,"source":"skype.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":687,"source":"skype.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":688,"source":"skype.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":90,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":688,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":378237,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA4LIAAEARBt3AqAEinTg0GzLdnFsALK5Hm\/oC27Di400dfPUDJrwFd8eoU\/psKrn9OzjyFuH7NFUpoc4x"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":688,"source":"skype.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":688,"source":"skype.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":689,"source":"skype.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":91,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":689,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":378237,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyTM0AAEAR4z7AqAEinTfrrTLdnEwAHgM8m\/wCyw55OL3+chZLjMlighndXw9\/qA=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":689,"source":"skype.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":689,"source":"skype.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":690,"source":"skype.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.157","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":92,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":690,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":378238,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5cNoAAEARvzrAqAEinTfrnTLdnEoAJXKym\/4Cz\/csSQ42SRwcVm84KNSC1Bge6u0+CtZPiaQ="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":690,"source":"skype.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.157","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":690,"source":"skype.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431969663378,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.157","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00435{"flow_id":87,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":691,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":505002,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYhOdN4KnwKgBIpxfw3yB0ZuyltYW+6ASOJDi6AAAAgQFrAQCCApOq7XZPiLc+gEDAwk="} 00423{"flow_id":87,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":692,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":505133,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0s6BAAEAGpXrAqAEinTeCp8N8nF+W1hb7gdGbs4AQECw5lAAAAQEICj4i3XlOq7XZ"} 00536{"flow_id":87,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":693,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969663,"pkt_ts_usec":505683,"pkt_caplen":145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":145,"pkt_l4_len":111,"pkt":"0NQSxnP1PBXCt3IOCABFAACDnKFAAEAGvCrAqAEinTeCp8N8nF+W1hb7gdGbs4AYECwikQAAAQEICj4i3XlOq7XZChG\/0yYPmKegA+hNcGZvZSHoQU++Nx5Rkm\/BbOmvh7jXIbPWsU9+9CW7Aer6Cao0MOGe9zx9ivMI2TavlPWiK+DRzmfsbbpjuMlmH0Tl0g=="} @@ -536,19 +536,19 @@ 00474{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":702,"source":"skype.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1431969664357,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":703,"source":"skype.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40007,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":94,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":703,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":405665,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8z44AAEARX+vAqAEi1cezpTLdnEcAKEGUnAACQndt5hKcGQjs\/aUFepuMkaIJ9906aCWz4pv6M2E="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":703,"source":"skype.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":703,"source":"skype.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":704,"source":"skype.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":95,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":704,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":405665,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyGYIAAEARfyPAqAEiQTffFDLdnGEAHnjQnAICuB3xnzqHf8BCJKQQ6ooGPwkzRg=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":704,"source":"skype.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":704,"source":"skype.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00485{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":705,"source":"skype.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":96,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":705,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":405843,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3zjoAAEARkxnAqAEiQAQXlDLdnEoAI3yfnAQC5t7RxPpucIQEcbOpo3n\/i37I7X5QLz7O"} -00525{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":705,"source":"skype.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":705,"source":"skype.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":706,"source":"skype.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":97,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":706,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":405843,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3gRQAAEARembAqAEib91NlDLdnF0AI32wnAYCAtkwZfUpvy0PrMgHjjv7gkQ5J07OrfdX"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":706,"source":"skype.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":706,"source":"skype.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":707,"source":"skype.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.141","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":98,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":707,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":405843,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1GOEAAEAR4qLAqAEib91NjTLdnFQAIf21nAgChdWCG2VT3PvRM4JN\/HMVRe1geqFvmA=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"skype.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.141","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"skype.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431969664405,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.141","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":19,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":708,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":812764,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0HPFAADcGRLBBN98hwKgBIgG7w24uYYI6XFDkhIARAB0PDgAAAQEICk2XsRI+IpIH"} 00456{"flow_id":65,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":709,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969664,"pkt_ts_usec":990164,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMCKZAAEAGUHjAqAEinTeCjMN2AbvInJlHrpWZfIAYECxNrQAAAQEICj4i40JOvfadOsfzaffo90GU9fGuBRpgbZPEZs9Bzxti"} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"skype.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1431969664990,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50045,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -567,19 +567,19 @@ 00444{"flow_id":101,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":719,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416513,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA9S9AAEAGY\/DAqAEinTeClsN+nEtADbnoAAAAALAC\/\/\/YlwAAAgQFtAEDAwUBAQgKPiLk6gAAAAAEAgAA"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":720,"source":"skype.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":102,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":720,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416714,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1j8QAAEARCNrAqAEiQTffGDLdnGAAISuNnAoCfsB5JB\/rTYpH1Pyy3TEn61xOyU3n6Q=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":720,"source":"skype.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":720,"source":"skype.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":721,"source":"skype.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.175","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":103,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":721,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416715,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/Ev0AAEAR0ADAqAEinTc4rzLdnE0AK5vynAwCv2wYRcgby0Lpb\/j9BzqAbRO\/1tuxNgazREl3CBLvd3M="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":721,"source":"skype.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.175","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":721,"source":"skype.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.175","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":722,"source":"skype.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":104,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":722,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416767,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0pwAAAEARuljAqAEiQAQXkjLdgQkAIJb3nA4CpT3k+\/yRRYMAziIEiKPZ4SNw4uYJ"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"skype.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"skype.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":723,"source":"skype.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":105,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":723,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416767,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2ZQAAAEARfiTAqAEinTc4kTLdnFsAImkAnBACXCxecPPKFtdeUw7sQSBvp3gi9mq4vcM="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":723,"source":"skype.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":723,"source":"skype.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":724,"source":"skype.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":106,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":724,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":416768,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+hGcAAEARenXAqAEib91KKzLdnEEAKumHnBICbsOSISjTImKbV\/UiCWod5a6w5EFlZL740jo5mcYkgQ=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":724,"source":"skype.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":724,"source":"skype.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431969665416,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":101,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":726,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":632166,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYiSdN4KWwKgBIpxLw35DcUQuQA256aASOJA7FQAAAgQFrAQCCApOt5+TPiLk6gEDAwk="} 00424{"flow_id":101,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":727,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":632245,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0tVZAAEAGo9XAqAEinTeClsN+nEtADbnpQ3FEL4AQECyRaAAAAQEICj4i5cFOt5+T"} 00532{"flow_id":101,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":728,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969665,"pkt_ts_usec":632843,"pkt_caplen":143,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":143,"pkt_l4_len":109,"pkt":"0NQSxnP1PBXCt3IOCABFAACBua5AAEAGnzDAqAEinTeClsN+nEtADbnpQ3FEL4AYECwSIgAAAQEICj4i5cFOt5+T207BU8RTpz6cl51LKBWtARK9wP6VlGI4+stPzH0uYPT1Iirrs3Q6E000sIWPSE+TE6j51s80FUJLgPFuh4yNWoNY6QY\/5AVyuzDhnvc="} @@ -592,19 +592,19 @@ 00496{"flow_id":71,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":735,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":195715,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"0NQSxnP1PBXCt3IOCABFAABmMmpAAEAGvObAqAEi1cezr8N3AbvoukrF6jj3F4AYECxIqAAAAQEICj4i5\/BO2zrq3Ik+3JoryHORYpUOodhZtdvbaLVaOrSVdhFGDoNFz\/ygR9NCUBkcRkZjFi6mIQWuXX4="} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":736,"source":"skype.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":107,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":736,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":429147,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0QwsAAEARVYDAqAEiQTffLDLdnE0AIF\/DnBQCMyjz3r9eJ18XTFVNiAvxrYpQ3ucg"} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":736,"source":"skype.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":736,"source":"skype.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":737,"source":"skype.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.26","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":108,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":737,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":429312,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA82TgAAEARDlzAqAEinTg0GjLdnFoAKNB4nBYCAAvRN+bFqY3YyxruA93YXf9Qo41EFxKazlLBv\/8="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":737,"source":"skype.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.26","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":737,"source":"skype.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.26","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":738,"source":"skype.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":109,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":738,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":429312,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/\/94AAEARYWbAqAEiQAQXmzLdnEQAK4rqnBgCdE2WfHkd94c\/GZASHmkYP3mRsrUzW7aH679XKkCN7wg="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":738,"source":"skype.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":738,"source":"skype.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":739,"source":"skype.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.41","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":110,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":739,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":429312,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3cPYAAEARJ5XAqAEiQTffKTLdnFsAIyQanBoCqUIPvRhVKRfli2TsAPxez+o30kiStRum"} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":739,"source":"skype.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.41","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":739,"source":"skype.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.41","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":740,"source":"skype.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.47","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":111,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":429312,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAy3VkAAEARCjDAqAEinTg0LzLdnF0AHgzhnBwC9HB1yp1CFIBUD5AqeEDWvWy7jA=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"skype.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.47","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":740,"source":"skype.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431969666429,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.47","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":87,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":741,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":480016,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8jDNAAEAGzN\/AqAEinTeCp8N8nF+W1hdKgdGcA4AYECk\/5wAAAQEICj4i6QxOq7X7zDi7upn8y1s="} 00483{"flow_id":99,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":743,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969666,"pkt_ts_usec":618248,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"0NQSxnP1PBXCt3IOCABFAABd03JAAEAGhX\/AqAEinTeCp8N9Abt3wuIecQen4YAYECwtAAAAAQEICj4i6ZVOq7eNha\/REPk0JK+jyXRvQAnIdnOzfqInh3kQnO9afU+VElpw2DvgAIcm25w="} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":744,"source":"skype.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1431969667019,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -621,19 +621,19 @@ 00442{"flow_id":113,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":753,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":439791,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAvH9AAEAGnJDAqAEinTeCpsOBnFXYqqHbAAAAALAC\/\/9QDQAAAgQFtAEDAwUBAQgKPiLsxwAAAAAEAgAA"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":754,"source":"skype.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":114,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":754,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":439986,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9SW0AAEAR5iPAqAEi1cezjTLdnE8AKQ5hnB4CGyqpujGNRC+tNfD9NfpLzFflMbzl80z6vtvIbjHD"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":754,"source":"skype.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":754,"source":"skype.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":755,"source":"skype.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":115,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":755,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":439986,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5JaMAAEARO5vAqAEiQAQXqDLdnEYAJeE7nCAClYKeY8U7yQoFLZ\/n5OmCV2u37neBgVGbscg="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":755,"source":"skype.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":755,"source":"skype.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431969667439,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":756,"source":"skype.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":116,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":756,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":440039,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/+CwAAEAR6vHAqAEinTc4jjLdnFcAKxxKnCIC+gceuOzI36Gk6bxAzIG\/CfJN2Kdzd\/KAG2cg42HExgA="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":756,"source":"skype.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":756,"source":"skype.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":757,"source":"skype.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":117,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":757,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":440039,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0paYAAEARVdzAqAEib91NjzLdnFYAIE1nnCQCSJLvZtGpgN01LZemo1XXZO+oxg0w"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":757,"source":"skype.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":757,"source":"skype.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":758,"source":"skype.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":118,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":758,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":440039,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBc7oAAEARJM\/AqAEiQTffITLdnEsALfH+nCYCgzglH2UUEeAloaKWvjnBLcR69MpntGSFdWneylROBFqJdg=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":758,"source":"skype.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":758,"source":"skype.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431969667440,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":113,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":760,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":679820,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYhSdN4KmwKgBIpxVw4FWpWbU2Kqh3KASOJCyZwAAAgQFrAQCCApOrGnnPiLsxwEDAwk="} 00424{"flow_id":113,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":761,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":679894,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA04YFAAEAGd5rAqAEinTeCpsOBnFXYqqHcVqVm1YAQECwIogAAAQEICj4i7bdOrGnn"} 00525{"flow_id":113,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":762,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969667,"pkt_ts_usec":680317,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"0NQSxnP1PBXCt3IOCABFAAB6xORAAEAGk\/HAqAEinTeCpsOBnFXYqqHcVqVm1YAYECy3pgAAAQEICj4i7bdOrGnndublI75nXubO21nQycJvJO84XcmJJcjmGsjdZZ7Sh0tXGkpbJzOfwgjXE\/IbWS5lhr9khfI7sGEed7z9CnOIWbYvFHUiqw=="} @@ -652,10 +652,10 @@ 00876{"flow_id":22,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":775,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":391015,"pkt_caplen":399,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":399,"pkt_l4_len":365,"pkt":"AQBef\/\/6oPPBbTu2CABFAAGBApwAAAQRATDAqAD+7\/\/\/+gQBB2wBbXKDTk9USUZZICogSFRUUC8xLjENCkhPU1Q6IDIzOS4yNTUuMjU1LjI1MDoxOTAwDQpDQUNIRS1DT05UUk9MOiBtYXgtYWdlPTEwMA0KTE9DQVRJT046IGh0dHA6Ly8xOTIuMTY4LjAuMjU0OjE5MDAvaWdkLnhtbA0KTlQ6IHVybjpzY2hlbWFzLXVwbnAtb3JnOmRldmljZTpXQU5Db25uZWN0aW9uRGV2aWNlOjENCk5UUzogc3NkcDphbGl2ZQ0KU0VSVkVSOiBUUC1MSU5LIFdpcmVsZXNzIE4gTmFubyBSb3V0ZXIgV1I3MDJOLCBVUG5QLzEuMA0KVVNOOiB1dWlkOnVwbnAtV0FOQ29ubmVjdGlvbkRldmljZS0xOTIxNjgwMjU0Nzg5MDAwMDE6OnVybjpzY2hlbWFzLXVwbnAtb3JnOmRldmljZTpXQU5Db25uZWN0aW9uRGV2aWNlOjENCg0K"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":776,"source":"skype.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":119,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":776,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":393491,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAuzMAAEARQDfAqAEib91NmzLdnEQALFAWnCgCEvePRGLJGr6Sre+ODORDkQCce9O5GJ9D557YPiPEFuAx"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":776,"source":"skype.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":776,"source":"skype.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":777,"source":"skype.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.143","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":120,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":777,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":393551,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/2XIAAEARv6rAqAEinTeCjzLdnFEAK32DnCoCUchv5aDS7Qgi\/2x8dTOyi7BA\/ZCxsEvRrtCtnVEnyoU="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":777,"source":"skype.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.143","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":777,"source":"skype.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1431969668393,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.143","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00535{"flow_id":19,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":779,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":477732,"pkt_caplen":145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":145,"pkt_l4_len":111,"pkt":"PBXCt3IO0NQSxnP1CABFAACDHPJAADcGRGBBN98hwKgBIgG7w24uYYHrXFDkhIAYAB1z8wAAAQEICk2XtLA+IpIHFgMBAEoCAABGAwFAG+SGAq3gKeF3dOVEucmctDExXgLdd50VSpYJul2ocCAcoOT2TGNRri+OTuHmdmoKiNXYxVyumMXkgfIqab+QWAAFAA=="} 00408{"flow_id":19,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":780,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":477830,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAomF9AAEAGwE3AqAEiQTffIcNuAbtcUOSEAAAAAFAEAADHvgAA"} 00442{"flow_id":3,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":781,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969668,"pkt_ts_usec":492204,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDB9wAAEAR71rAqAEiwKgBAdmfADUAL7TEHKMBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} @@ -684,13 +684,13 @@ 00466{"flow_id":122,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":802,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":302385,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABSXh5AAEAG+t\/AqAEinTeCpsODAbsS3ITHvVXOp4AYECx5qgAAAQEICj4i9AhOrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":803,"source":"skype.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":123,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":803,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":408592,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA749YAAEARS6HAqAEi1cezqDLdnEYAJ90VnCwCpNRKktf4Qi\/bdq+yPcZvRHBM0A5YqXcB1iPXfA=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":803,"source":"skype.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":803,"source":"skype.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":804,"source":"skype.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":124,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":804,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":408592,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5xgUAAEARIZrAqAEinTg0EjLdgQkAJZdLnC4CEFtjW45ZN3BY7kxO5IarNwXkC3qnvdRTMpg="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":804,"source":"skype.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":804,"source":"skype.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":805,"source":"skype.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":125,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":805,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":408664,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9eQsAAEARtnjAqAEi1cezmjLdnGIAKUaUnDACIJVxUOV7zs6xYvMq6EYi6E1yxVZ+ttOndiNbBj7C"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":805,"source":"skype.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":805,"source":"skype.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431969669408,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":113,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":806,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":412702,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8SP9AAEAGEBXAqAEinTeCpsOBnFXYqqIiVqVnNYAYEClbUwAAAQEICj4i9HZOrGolRtJrmlCDoq4="} 00436{"flow_id":50,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":807,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":830994,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8FSdAAEAGjenAqAEinTc4qsNxnE+r6BLEPu7rjYAYECqKcwAAAQEICj4i9hhNea2iMpsmfs9xo5c="} 00465{"flow_id":122,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":808,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969669,"pkt_ts_usec":840170,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABSr9pAAEAGqSPAqAEinTeCpsODAbsS3ITHvVXOp4AYECx3kQAAAQEICj4i9iFOrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} @@ -749,10 +749,10 @@ 00455{"flow_id":21,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":814,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":410891,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLtqQAAEARQIrAqAEiwKgBAeF+ADUAN7bIb04BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":815,"source":"skype.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":126,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":815,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":418370,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1a3EAAEARxCLAqAEi1cezkjLdnF4AIe2\/nDICH70PgbauE\/TDe2jJ8Wqi40Tw\/dlcGg=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":815,"source":"skype.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":815,"source":"skype.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":816,"source":"skype.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.32","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":127,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":816,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":418371,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4XYMAAEARoWrAqAEib91KIDLdnEkAJPvTnDQCE7A5vpizco713fAfzrDXfyhKHUClX6xRMw=="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":816,"source":"skype.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.32","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":816,"source":"skype.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":1,"flow_first_seen":1431969670418,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.32","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00457{"flow_id":65,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":817,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":473991,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMASdAAEAGV\/fAqAEinTeCjMN2AbvInJlHrpWZfIAYECw4VQAAAQEICj4i+JpOvfadOsfzaffo90GU9fGuBRpgbZPEZs9Bzxti"} 00465{"flow_id":122,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":818,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":713987,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABStFVAAEAGpKjAqAEinTeCpsODAbsS3ITHvVXOp4AYECx0KQAAAQEICj4i+YlOrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} 00483{"flow_id":99,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":819,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969670,"pkt_ts_usec":895271,"pkt_caplen":107,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":107,"pkt_l4_len":73,"pkt":"0NQSxnP1PBXCt3IOCABFAABddstAAEAG4ibAqAEinTeCp8N9Abt3wuIecQen4YAYECwcVwAAAQEICj4i+j5Oq7eNha\/REPk0JK+jyXRvQAnIdnOzfqInh3kQnO9afU+VElpw2DvgAIcm25w="} @@ -760,13 +760,13 @@ 00438{"flow_id":101,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":822,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":300551,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8bcNAAEAG62DAqAEinTeClsN+nEtADbo2Q3FEmYAYECjHhQAAAQEICj4i+9JOt5\/KwFGYWtZyg7g="} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":824,"source":"skype.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.141","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":128,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":824,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":427254,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7f50AAEAR4bnAqAEiQAQXjTLdnEQAJ4UFnDYCwyd8EHi1QBLXs1KZU1iJVh3lwESpNueb3tiaIg=="} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":824,"source":"skype.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.141","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":824,"source":"skype.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.141","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":825,"source":"skype.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":129,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":825,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":427254,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ovIAAEAR9aDAqAEiQTffHDLdnFoAKLy9nDgCw\/trQW+yBgre1M\/iGb+xrR1ukS\/k6lR8WrcUGNw="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":825,"source":"skype.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":825,"source":"skype.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":826,"source":"skype.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.161","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":130,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":826,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":427327,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA3g4AAEARUfvAqAEinTfroTLdnEsALJxsnDoCIAhyfiAhHAGT2pPsDhuBxLXCl+D8eTQt2\/ZTx9MpLSju"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":826,"source":"skype.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.161","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":826,"source":"skype.pcap","alias":"nDPId-test","flow_id":130,"flow_packet_id":1,"flow_first_seen":1431969671427,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.161","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00525{"flow_id":64,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":827,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":841809,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"0NQSxnP1PBXCt3IOCABFAAB684hAAEAGr0nAqAEinTc4qsN1AbtlArNVviBnW4AYECzChgAAAQEICj4i\/e9Nea82lrtEvF7Syi3sYudbWmm1LLmltdXITy9EZvRGZ4\/xmZ+XSmldmKNIhY33FGOH7bkZm8kH56oaXL6ossqblsc6QCTpmqw22A=="} 00678{"flow_id":18,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":828,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969671,"pkt_ts_usec":883043,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtolVAAEAGnHfAqAEiF84hpsNtAbuewXpuGKHN44AYECyK2AAAAQEICj4i\/hjsLkk6FgMBALQBAACwAwNVWh9r1BitCFD8cZbUoP0jV12FHPzKsJViTeYgJXwI\/wAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00466{"flow_id":122,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":829,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":261205,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABSOtRAAEAGHirAqAEinTeCpsODAbsS3ITHvVXOp4AYECxuIAAAAQEICj4i\/5JOrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} @@ -778,10 +778,10 @@ 00424{"flow_id":65,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":835,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":489205,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0mkVAAEAGvvDAqAEinTeCjMN2AbvInJlfrpWZfIARECyRzgAAAQEICj4jAHVOvfad"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":836,"source":"skype.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":131,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":836,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":489344,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0NOAAAEARZEfAqAEinTeCkDLdnGIAINainDwChxJXV87XhkbitLg+A\/cA051ANFNY"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":836,"source":"skype.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":836,"source":"skype.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":837,"source":"skype.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":132,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":837,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":489344,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2EcMAAEAR7TnAqAEib91KEzLdnEEAItfhnD4Cb3aeHJFamREFARmu+jDLOabt8VoC3Pk="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":837,"source":"skype.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":837,"source":"skype.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431969672489,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00475{"flow_id":112,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":838,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":767407,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"0NQSxnP1PBXCt3IOCABFAABX+H1AAEAGYIvAqAEinTeClsOAAbtI+poyuVVQX4AYECxVgwAAAQEICj4jAYtOt6FDtE+JMLnPtxIKxglVlecVLUAud036XUzec3hM4iMJiZPeQZY="} 00437{"flow_id":57,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":839,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969672,"pkt_ts_usec":917592,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8JB1AAEAGy13AqAEi1cezr8NznFXnJeT4bf1jqoAYECqxxgAAAQEICj4jAiFO2zlegPUYPB\/96j4="} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":841,"source":"skype.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50053,"dst_port":40030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -792,13 +792,13 @@ 00442{"flow_id":135,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":843,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":443716,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA3dtAAEAG4QXAqAEib91KL8OHnF60mgT1AAAAALAC\/\/9fYAAAAgQFtAEDAwUBAQgKPiMELQAAAAAEAgAA"} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":844,"source":"skype.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":136,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":844,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":443865,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0XMQAAEARBHrAqAEiQAQXrTLdnFEAIKzLnEACNoZuauEq3ADhWmqb7oTzdlIdyJ9N"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":844,"source":"skype.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":844,"source":"skype.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":845,"source":"skype.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.153","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":137,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":845,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":443897,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7lioAAEARmezAqAEinTfrmTLdnFcAJ4lunEIC66wPUwGEAyW45bIdeHP6QiT0x60Zbz70ciSKMQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":845,"source":"skype.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.153","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":845,"source":"skype.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.153","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":846,"source":"skype.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":138,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":846,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":443922,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA180cAAEARCDTAqAEib91NlTLdnF4AIdImnEQCEhW3FidGQ7GJtk\/GLqF7d8vgcOXTwQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":846,"source":"skype.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":846,"source":"skype.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431969673443,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":134,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":847,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":574373,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYiGdN4KZwKgBIpxFw4bvEzbne1pKoqASOJB0cwAAAgQFrAQCCApOtNyOPiMELQEDAwk="} 00424{"flow_id":134,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":848,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":574496,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0MLVAAEAGKHTAqAEinTeCmcOGnEV7Wkqi7xM26IAQECzLGgAAAQEICj4jBLBOtNyO"} 00576{"flow_id":134,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":849,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969673,"pkt_ts_usec":575107,"pkt_caplen":172,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":172,"pkt_l4_len":138,"pkt":"0NQSxnP1PBXCt3IOCABFAACeCKhAAEAGUBfAqAEinTeCmcOGnEV7Wkqi7xM26IAYECzq0wAAAQEICj4jBLBOtNyOAWZkzughlCNCvXtxaSBC7JDDHESH2Je\/F\/dAa\/dGMFUSCfM7GfI9QD7EeE1HvoXmVLVi66CRjiesLXojeIkm3wSlkltQgb6XXB2qkyh5Vk+0lcLLAHHuBwwN2gPYaYa\/ZIXyO7BhHne8\/Q=="} @@ -825,11 +825,11 @@ 00436{"flow_id":133,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":871,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":316206,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8HghAAEAGhSDAqAEinTc4ksOFnF5LaK51T0tw1IAYECns8gAAAQEICj4jB5NNhXFJby9fpLXtPtU="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":872,"source":"skype.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":139,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":872,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":456524,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBxa4AAEAR02nAqAEinTeCkjLdnFoALfPInEYCTMX9D0zWqHZlar9rRJ4nLA7eV\/fFhp0UOFHwVjJRpWMfLA=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":872,"source":"skype.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":872,"source":"skype.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":57,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":456591,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0Y3RAAEAGjA7AqAEi1cezr8NznFXnJeUAbf1jqoARECpPPQAAAQEICj4jCB9O2zle"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":874,"source":"skype.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":140,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":456592,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9FOcAAEARGqjAqAEi1cezjzLdnFYAKftynEgChXSqdM1qvdY\/tcyUx+hTJaaUvSW+LNUHctwmtBhJ"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":874,"source":"skype.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":874,"source":"skype.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1431969674456,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":71,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":456592,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0A1lAAEAG7CnAqAEi1cezr8N3Abvoukr36jj3F4ARECxxEQAAAQEICj4jCB9O2zrq"} 00436{"flow_id":87,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969674,"pkt_ts_usec":534411,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8orZAAEAGtlzAqAEinTeCp8N8nF+W1hdKgdGcA4AYECkghwAAAQEICj4jCGxOq7X7zDi7upn8y1s="} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":878,"source":"skype.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_first_seen":1431969675055,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50056,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -858,13 +858,13 @@ 00443{"flow_id":144,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":897,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":413612,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAarpAAEAGVDDAqAEib91KJsOLnE+UB73TAAAAALAC\/\/+\/fwAAAgQFtAEDAwUBAQgKPiML1gAAAAAEAgAA"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":898,"source":"skype.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.21","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":145,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":898,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":413818,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5rAwAAEAR7JDAqAEiQTffFTLdnFsAJTYGnEoCYEAkEhPrC3cXaZ2QhtIeOoxIY9w9Ekoojl8="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":898,"source":"skype.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.21","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":898,"source":"skype.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.21","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":899,"source":"skype.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00424{"flow_id":146,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":899,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":413819,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAySgUAAEARsYLAqAEib91NjDLdnEMAHpNUnEwCeUQO24lPxsdSE1aywi7G9Ehfag=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":899,"source":"skype.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":899,"source":"skype.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":900,"source":"skype.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":147,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":900,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":413876,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3KwsAAEARbhfAqAEinTeCkjLdgQkAI6nfnE4CnxxG0E+kNYaCqSmEqqaVzyCf2xFtLT6I"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":900,"source":"skype.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":900,"source":"skype.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":1,"flow_first_seen":1431969675413,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00482{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":901,"source":"skype.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":1,"flow_first_seen":1431969675567,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":50024,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00411{"flow_id":148,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":901,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":567066,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAoxtNAAEAGPGLAqAEiEaxkJMNoAbucCLSTZ4D+ClAR\/\/\/87QAA"} 00424{"flow_id":143,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":667575,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0luxAADYGMgFv3UovwKgBIgG7w4qMyvZFkcpNT4AQAB3bbAAAAQEICk2FYKk+Iwub"} @@ -880,10 +880,10 @@ 00462{"flow_id":141,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":912,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":913705,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABPam1AAEAGOKjAqAEinTc4ksOIAbsXgt5RB+ihfoAYECzxxQAAAQEICj4jDcZNhXLb+CbW3lZbBv40\/beInvTLb7s0B7Su\/nEv8OsV"} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":913,"source":"skype.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55159,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00460{"flow_id":149,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":913,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":950087,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABPisQAAEARbGbAqAEiwKgBAdd3ADUAO4zaTRYBAAABAAAAAAAAAWEGY29uZmlnBXNreXBlDnRyYWZmaWNtYW5hZ2VyA25ldAAAAQAB"} -00666{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":913,"source":"skype.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55159,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00672{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":913,"source":"skype.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55159,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":914,"source":"skype.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63108,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00461{"flow_id":150,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":914,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969675,"pkt_ts_usec":950344,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABPsQsAAEARRh\/AqAEiwKgBAfaEADUAO+FnvnsBAAABAAAAAAAAAWEGY29uZmlnBXNreXBlDnRyYWZmaWNtYW5hZ2VyA25ldAAAHAAB"} -00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":914,"source":"skype.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63108,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00673{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":914,"source":"skype.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431969675950,"flow_last_seen":0,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63108,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.trafficmanager.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00423{"flow_id":144,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":915,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":3705,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0uhNAADcGDeNv3UomwKgBIpxPw4sbzRmAlAe+CoAQAB3XZgAAAQEICk1\/o5M+Iwz7"} 00523{"flow_id":144,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":916,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":7380,"pkt_caplen":136,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":136,"pkt_l4_len":102,"pkt":"PBXCt3IO0NQSxnP1CABFAAB6uhRAADcGDZxv3UomwKgBIpxPw4sbzRmAlAe+CoAYAB1g3QAAAQEICk1\/o5Q+Iwz7W0+jDkwYdyalyU6Dj4HU2pOBY1mmiLVz6n0Ki\/31ujL4cTtm9Z9iwycIFTqWFFeNZVIbEEF+VxzdalPoORYPdFWCi8Axrg=="} 00422{"flow_id":144,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":917,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":7446,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA06rBAAEAG1EXAqAEib91KJsOLnE+UB74KG80ZxoAQECnF6wAAAQEICj4jDiNNf6OU"} @@ -892,10 +892,10 @@ 00437{"flow_id":51,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":920,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":399049,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8KJpAAEAGMJTAqAEinTeCjMNynGH\/hzYDZw7DuIAZECmalwAAAQEICj4jD6pOvfULJJFwCjegzGQ="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":921,"source":"skype.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":151,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":921,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":429637,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBH10AAEARELrAqAEinTfrkzLdnFQALfL6nFACIA2HAe7F64ULrxZmZzlp\/IcJjWPYQGVuGoQXNRtdAcprsg=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":921,"source":"skype.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":921,"source":"skype.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":922,"source":"skype.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":152,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":922,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":429638,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9SBkAAEARs0rAqAEib91NpTLdnFQAKf+JnFIC4bFrPlS3SgwUQ0ZkfJhi4Ibaq\/8x3HMPk6r8UbN8"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":922,"source":"skype.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":922,"source":"skype.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431969676429,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":101,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":923,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":440226,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8iAlAAEAG0RrAqAEinTeClsN+nEtADbo2Q3FEmYAYECizhAAAAQEICj4jD9NOt5\/KwFGYWtZyg7g="} 00437{"flow_id":134,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":927,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":613109,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8MwdAAEAGJhrAqAEinTeCmcOGnEV7WksM7xM3SYAYECgt5AAAAQEICj4jEH5OtNyvZO1SW4ugTYc="} 00475{"flow_id":142,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":928,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969676,"pkt_ts_usec":709727,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"0NQSxnP1PBXCt3IOCABFAABWkfJAAEAGxxTAqAEinTeCmcOJAbvJCUV1l+7ieIAYECzCeQAAAQEICj4jEN5OtN5CdYilVbtaCwK\/tgRArD4Y28szEXDIjTbyD0VdE11jWOuPGA=="} @@ -915,23 +915,23 @@ 00437{"flow_id":135,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":941,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":436520,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8KzpAAEAGk6vAqAEib91KL8OHnF60mgVan9mDBYAYECqYuwAAAQEICj4jE7FNhV8Xx9YMHiFnIWo="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":942,"source":"skype.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.166","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":154,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":942,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":439255,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/kxIAAEARaE7AqAEib91NpjLdnEsAK\/dAnFQCl1hxbJqFe\/EoPOrYejcO5KpAaYBpd\/JMh2XsR696PgE="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"skype.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.166","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"skype.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.166","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":943,"source":"skype.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":155,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":943,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":439256,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4mEQAAEARAMrAqAEinTeCpTLdnFoAJC3GnFYCIQGR7TxLVU8tswjr1LACebeVCHQalWySEQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":943,"source":"skype.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":943,"source":"skype.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":944,"source":"skype.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":156,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":944,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":439327,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1f9wAAEARGT3AqAEinTeCnTLdnE0AIXYPnFgCFJgmOhVj0TGqdlU73IOUBy59C5OuhQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":944,"source":"skype.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":944,"source":"skype.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431969677439,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_id":71,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":945,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":581712,"pkt_caplen":116,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":116,"pkt_l4_len":82,"pkt":"0NQSxnP1PBXCt3IOCABFAABm1jFAAEAGGR\/AqAEi1cezr8N3AbvoukrF6jj3F4AZECwcVgAAAQEICj4jFEFO2zrq3Ik+3JoryHORYpUOodhZtdvbaLVaOrSVdhFGDoNFz\/ygR9NCUBkcRkZjFi6mIQWuXX4="} 00436{"flow_id":144,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":947,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":680875,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA89bNAAEAGyTrAqAEib91KJsOLnE+UB74KG80ZxoAYECkFoQAAAQEICj4jFKRNf6OUySqTc3CS7Ig="} 00425{"flow_id":153,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":948,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":689309,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA05MhAADcG4y1v3UomwKgBIgG7w48O1kHwtGxiMoAQAB2JxAAAAQEICk1\/pTg+IxOD"} 00499{"flow_id":153,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":949,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":689388,"pkt_caplen":120,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":120,"pkt_l4_len":86,"pkt":"0NQSxnP1PBXCt3IOCABFAABq3jRAAEAG4IvAqAEib91KJsOPAbu0bGIyDtZB8IAYECxlQwAAAQEICj4jFKxNf6U4DpQ6T7GhI\/HZuALGyyd6FuE62cjswcclHGXEXQQQrFo1hEMiHK+aF1hYQEgpCBKH6FPKIRys"} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":950,"source":"skype.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58458,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":157,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":950,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":975446,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLNkoAAEARwOTAqAEiwKgBAeRaADUAN2o90\/0BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAABAAE="} -00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":950,"source":"skype.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58458,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":950,"source":"skype.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58458,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":951,"source":"skype.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49360,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":158,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":951,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":975770,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLu3AAAEARO77AqAEiwKgBAcDQADUANww\/OoYBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} -00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":951,"source":"skype.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49360,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":951,"source":"skype.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":1,"flow_first_seen":1431969677975,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49360,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00475{"flow_id":112,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":952,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969677,"pkt_ts_usec":985081,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"0NQSxnP1PBXCt3IOCABFAABXYOVAAEAG+CPAqAEinTeClsOAAbtI+poyuVVQX4AYECxBOwAAAQEICj4jFdNOt6FDtE+JMLnPtxIKxglVlecVLUAud036XUzec3hM4iMJiZPeQZY="} 00436{"flow_id":50,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":953,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":127257,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA81kZAAEAGzMnAqAEinTc4qsNxnE+r6BLEPu7rjYAZECpqKQAAAQEICj4jFmFNea2iMpsmfs9xo5c="} 00456{"flow_id":65,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":954,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":128519,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMjBFAAEAGzQzAqAEinTeCjMN2AbvInJlHrpWZfIAZECwajAAAAQEICj4jFmJOvfadOsfzaffo90GU9fGuBRpgbZPEZs9Bzxti"} @@ -943,11 +943,11 @@ 00686{"flow_id":12,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":962,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":380830,"pkt_caplen":257,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":257,"pkt_l4_len":223,"pkt":"0NQSxnP1PBXCt3IOCABFAADzJGNAAEAG8tbAqAEiF99JIsNrAbvkkjeTMYDD\/oAZECxrVgAAAQEICj4jF13301nQFgMBALoBAAC2AwNVWh9qIUBTYdqPuvpJ\/EUxWvWdVTCc6qQWuOlUPkFPXAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAQwAAABkAFwAAFGFwcHMuc2t5cGVhc3NldHMuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":963,"source":"skype.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.145","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":159,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":963,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":448473,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA28WwAAEARPrfAqAEinTfrkTLdnFYAInUwnFoCL\/MPOOsaaRslv0+ih8hUClTBOiOZV0s="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":963,"source":"skype.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.145","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":963,"source":"skype.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.145","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":87,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":964,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":448539,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0yERAAEAGkNbAqAEinTeCp8N8nF+W1hdSgdGcA4ARECn+pQAAAQEICj4jF6BOq7X7"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":965,"source":"skype.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.26","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":160,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":965,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":448540,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBiiMAAEARDm3AqAEiQTffGjLdnEQALZMdnFwCzKFKSd3cA9PLS4BXWJFRrjZHyG3cJPIPdrTAqEb6jU8VDg=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":965,"source":"skype.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.26","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":965,"source":"skype.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":1,"flow_first_seen":1431969678448,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.26","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00424{"flow_id":99,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":966,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":448540,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA09b9AAEAGY1vAqAEinTeCp8N9Abt3wuJHcQen4YARECzwvgAAAQEICj4jF6BOq7eN"} 00463{"flow_id":141,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":967,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":486903,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABP7\/JAAEAGsyLAqAEinTc4ksOIAbsXgt5RB+ihfoAYECznxQAAAQEICj4jF8ZNhXLb+CbW3lZbBv40\/beInvTLb7s0B7Su\/nEv8OsV"} 00677{"flow_id":18,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":968,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969678,"pkt_ts_usec":578114,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtqoVAAEAGlEfAqAEiF84hpsNtAbuewXpuGKHN44AYECxwzwAAAQEICj4jGCHsLkk6FgMBALQBAACwAwNVWh9r1BitCFD8cZbUoP0jV12FHPzKsJViTeYgJXwI\/wAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} @@ -960,13 +960,13 @@ 00443{"flow_id":161,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":975,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":451353,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAZ+RAAEAG8MXAqAEiQTffDMORnF\/vfD8JAAAAALAC\/\/9szQAAAgQFtAEDAwUBAQgKPiMbhwAAAAAEAgAA"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":976,"source":"skype.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.151","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":162,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":976,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":455907,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6zKQAAEARzHXAqAEinTeClzLdnFEAJhOjnF4CtwUXw\/VWCApVJdrfxkhI5qU9AKuGw3faL7f5"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":976,"source":"skype.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.151","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":976,"source":"skype.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.151","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":977,"source":"skype.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":163,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":977,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":455908,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5dCsAAEARu0zAqAEi1cezqjLdnEsAJQhSnGAC6QwwmBRocZoeU0bscPTURL89AdihxLtaI+k="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":977,"source":"skype.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":977,"source":"skype.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":978,"source":"skype.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.176","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":164,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":978,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":455968,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7lc0AAEARZY3AqAEib91NsDLdnFQAJ2jKnGICi6AMRljZtq+Es\/pWkLbSJ\/TvDoZrPj0F5hXOgQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":978,"source":"skype.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.176","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":978,"source":"skype.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431969679455,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.176","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":161,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":979,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":581118,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYa5BN98MwKgBIpxfw5E\/Sv9r73w\/CqASOJDLRwAAAgQFrAQCCApNoe2VPiMbhwEDAwk="} 00427{"flow_id":161,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":980,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":581242,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0cmZAAEAG5k\/AqAEiQTffDMORnF\/vfD8KP0r\/bIAQECwh8QAAAQEICj4jHAhNoe2V"} 00553{"flow_id":161,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":981,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969679,"pkt_ts_usec":581781,"pkt_caplen":156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":156,"pkt_l4_len":122,"pkt":"0NQSxnP1PBXCt3IOCABFAACOIGxAAEAGN\/DAqAEiQTffDMORnF\/vfD8KP0r\/bIAYECwRzAAAAQEICj4jHAhNoe2VfNU8dhpM38DGRSZmxic4e0pEdx+lOUJozRNK0FR\/ZhB0X2eExkEyGGlGIiJpdaUcTRpDGKnG\/6TFMnvwoV63\/D1Ks8iZ9m9UtWLroJGOJ6wteiN4iSbfBKWS"} @@ -1009,11 +1009,11 @@ 00426{"flow_id":101,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":994,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":467231,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0sU1AAEAGp97AqAEinTeClsN+nEtADbo+Q3FEmYAREChWvAAAAQEICj4jH3pOt5\/K"} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":995,"source":"skype.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":165,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":995,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":467231,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5uekAAEARKTXAqAEinTc4lDLdnEoAJXlNnGQC\/A+kfzeJzZXZQQBxWhYkhXip+EvBFG8rlU4="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":995,"source":"skype.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":995,"source":"skype.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.148","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00425{"flow_id":112,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":996,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":467232,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0zLtAAEAGjHDAqAEinTeClsOAAbtI+ppVuVVQX4ARECyFHwAAAQEICj4jH3pOt6FD"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":997,"source":"skype.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":166,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":997,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":467232,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyVhkAAEAR2gHAqAEinTfrnjLdnF8AHti+nGYCSGBvJFR\/HGq\/K9Cny1\/vxLQHiA=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":997,"source":"skype.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":997,"source":"skype.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431969680467,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":135,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":998,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":631037,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8Fu9AAEAGp\/bAqAEib91KL8OHnF60mgVan9mDBYAYECqMTwAAAQEICj4jIB1NhV8Xx9YMHiFnIWo="} 00466{"flow_id":122,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":999,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969680,"pkt_ts_usec":766244,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABSh+RAAEAG0RnAqAEinTeCpsODAbsS3ITHvVXOp4AYECxNDgAAAQEICj4jIKROrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} 00477{"flow_id":142,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1000,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":41663,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"0NQSxnP1PBXCt3IOCABFAABWkJdAAEAGyG\/AqAEinTeCmcOJAbvJCUV1l+7ieIAYECyxoAAAAQEICj4jIbdOtN5CdYilVbtaCwK\/tgRArD4Y28szEXDIjTbyD0VdE11jWOuPGA=="} @@ -1031,13 +1031,13 @@ 00444{"flow_id":168,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1010,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":480233,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA\/b9AAEAGpVbAqAEinTc4oMOTnFuhu64eAAAAALAC\/\/+OBAAAAgQFtAEDAwUBAQgKPiMjagAAAAAEAgAA"} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1011,"source":"skype.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.162","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":169,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1011,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":480376,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4YcMAAEARzb3AqAEi1cezojLdnF0AJAuMnGgC2mPP3NT+NgZcfouOKEVgI\/tI0sJfUuMhDA=="} -00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1011,"source":"skype.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.162","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1011,"source":"skype.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.162","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1012,"source":"skype.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":170,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1012,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":480376,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1+dEAAEARBS\/AqAEib91KEDLdnGAAIfCsnGoCw1fhnSu+3d\/Tw+s36JFjatVqYPGvPQ=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1012,"source":"skype.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1012,"source":"skype.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1013,"source":"skype.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.159","src_port":13021,"dst_port":40021,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":171,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1013,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":480429,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyaGwAAEARx63AqAEinTfrnzLdnFUAHmVKnGwCxXHmKlMo0hJpMwmU59yIG9tJmA=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1013,"source":"skype.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.159","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1013,"source":"skype.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431969681480,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.159","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00464{"flow_id":141,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1014,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":580971,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABPIXdAAEAGgZ7AqAEinTc4ksOIAbsXgt5RB+ihfoAYECzbvQAAAQEICj4jI85NhXLb+CbW3lZbBv40\/beInvTLb7s0B7Su\/nEv8OsV"} 00437{"flow_id":168,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1015,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":627128,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADMGsBqdNzigwKgBIpxbw5OkoMOPobuuH6ASOJAefQAAAgQFrAQCCApNfpJAPiMjagEDAwk="} 00426{"flow_id":168,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1016,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969681,"pkt_ts_usec":627257,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0mLVAAEAGCm3AqAEinTc4oMOTnFuhu64fpKDDkIAQECx1FQAAAQEICj4jI\/xNfpJA"} @@ -1055,10 +1055,10 @@ 00426{"flow_id":122,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1029,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":488799,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA07TtAAEAGa+DAqAEinTeCpsODAbsS3ITlvVXOp4ARECx8LQAAAQEICj4jJ1VOrGuY"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1030,"source":"skype.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":172,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1030,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":488870,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4pYYAAEARPZvAqAEinTc4kjLdgQkAJLU7nG4Cyw+0E3ewR9IGP0eBLCPkEu6cvusCSULx8g=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1030,"source":"skype.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1030,"source":"skype.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1031,"source":"skype.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":173,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1031,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":488871,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA2L4AAEARJivAqAEib91KHDLdnE4ALJRcnHACG8tsqKlSc3O3hWaMTNmN0BY4DMi8SBQzDHozUa6r8phn"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1031,"source":"skype.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1031,"source":"skype.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431969682488,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":144,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1032,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":496465,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8hMBAAEAGOi7AqAEib91KJsOLnE+UB74KG80ZxoAYECny6AAAAQEICj4jJ1xNf6OUySqTc3CS7Ig="} 00440{"flow_id":161,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1033,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":602614,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ydJAAEAGjtvAqAEiQTffDMORnF\/vfD9kP0r\/xIAYECmapwAAAQEICj4jJ8ZNoe23pd7yTaWfPN4="} 00495{"flow_id":167,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1036,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969682,"pkt_ts_usec":754990,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"0NQSxnP1PBXCt3IOCABFAABnIoNAAEAGNgDAqAEiQTffDMOSAbvQogDzbPVBKoAYECwLFAAAAQEICj4jKFxNoe9JdRKYsr25V5AAdpQR0WFwQXZONwsp2+ImLRVUPhbhlzT9d0d7m6HpVNUn8Hw+fr6YtSFt"} @@ -1074,21 +1074,21 @@ 00486{"flow_id":174,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":375477,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"0NQSxnP1PBXCt3IOCABFAABeYkJAAEAGQLbAqAEinTc4oMOVAbs\/vde5DvO1MYAYECzDbwAAAQEICj4jKsZNfpP1C\/K+P2bJpeJPHa2PUHDULtdZf\/0zeGwCQKqXzvyh2rxHpWJ9WEovTk91"} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1048,"source":"skype.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54343,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00459{"flow_id":175,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":445395,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLY\/4AAEARkzDAqAEiwKgBAdRHADUAN3UY\/nwBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAABAAE="} -00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1048,"source":"skype.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54343,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst13.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1048,"source":"skype.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54343,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst13.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1049,"source":"skype.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58368,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":176,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":445606,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLbZEAAEARiZ3AqAEiwKgBAeQAADUAN6zvm+wBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAAcAAE="} -00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1049,"source":"skype.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58368,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst13.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00670{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1049,"source":"skype.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431969683445,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58368,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst13.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1050,"source":"skype.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50070,"dst_port":40018,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":177,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1050,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":498513,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAjFBAAEAGzLvAqAEinTeCqsOWnFJsNFWpAAAAALAC\/\/\/KJgAAAgQFtAEDAwUBAQgKPiMrQAAAAAAEAgAA"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1051,"source":"skype.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":178,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1051,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":498651,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAygKMAAEARGILAqAEinTeClDLdnFMAHuO+nHICw5e0uFvnoh7r2z7q0Ash9G6vuA=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1051,"source":"skype.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1051,"source":"skype.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1052,"source":"skype.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.37","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":179,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1052,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":498651,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA37XsAAEAR+hLAqAEinTg0JTLdnGAAI2eBnHQCCWFRyRLVPOTLcRjYZLb3DOT1DUSOmuDR"} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1052,"source":"skype.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.37","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1052,"source":"skype.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.37","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1053,"source":"skype.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":180,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1053,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":498704,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1nZ0AAEARXdnAqAEib91NmjLdnFEAIcopnHYCxd71ZoU+BTO6L2LN9kiyomjWgPGl4A=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1053,"source":"skype.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1053,"source":"skype.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431969683498,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00437{"flow_id":177,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1054,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":623605,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYhCdN4KqwKgBIpxSw5bt8UdnbDRVqqASOJAWbAAAAgQFrAQCCApOqggfPiMrQAEDAwk="} 00425{"flow_id":177,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1055,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":623712,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0bWZAAEAG67HAqAEinTeCqsOWnFJsNFWq7fFHaIAQECxtGQAAAQEICj4jK71Oqggf"} 00505{"flow_id":177,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1056,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969683,"pkt_ts_usec":624257,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"0NQSxnP1PBXCt3IOCABFAABrizRAAEAGzazAqAEinTeCqsOWnFJsNFWq7fFHaIAYECx1igAAAQEICj4jK71Oqggf1scwOyi+GNro1zNlkpz1kJCutCUd78rawR2K0Dss\/kuexdEgM5cPtj8qxMgNmwBXm5DB\/tecXQ=="} @@ -1106,10 +1106,10 @@ 00495{"flow_id":167,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1068,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":324140,"pkt_caplen":117,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":117,"pkt_l4_len":83,"pkt":"0NQSxnP1PBXCt3IOCABFAABnNhdAAEAGImzAqAEiQTffDMOSAbvQogDzbPVBKoAYECwE+wAAAQEICj4jLnVNoe9JdRKYsr25V5AAdpQR0WFwQXZONwsp2+ImLRVUPhbhlzT9d0d7m6HpVNUn8Hw+fr6YtSFt"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1069,"source":"skype.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.172","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":181,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1069,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":467205,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA16v8AAEARrgrAqAEinTeCrDLdnFMAIRT0nHgCu2bzH4JB7obGwPAa3nMCpmcjtPyNNg=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1069,"source":"skype.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.172","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1069,"source":"skype.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.172","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1070,"source":"skype.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":182,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1070,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":467279,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8hr8AAEAReCLAqAEib91KKDLdnFIAKIqNnHoCPuiFRI7wAmsXvw\/hsEg3lYrpYaj71nbGjF\/D9YI="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1070,"source":"skype.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1070,"source":"skype.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431969684467,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00458{"flow_id":175,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1072,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":539079,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLqeAAAEARTU7AqAEiwKgBAdRHADUAN3UY\/nwBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAABAAE="} 00457{"flow_id":176,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1073,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":539162,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLQlQAAEARtNrAqAEiwKgBAeQAADUAN6zvm+wBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAAcAAE="} 00487{"flow_id":174,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1075,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969684,"pkt_ts_usec":876496,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"0NQSxnP1PBXCt3IOCABFAABe\/1RAAEAGo6PAqAEinTc4oMOVAbs\/vde5DvO1MYAYECy9mgAAAQEICj4jMJtNfpP1C\/K+P2bJpeJPHa2PUHDULtdZf\/0zeGwCQKqXzvyh2rxHpWJ9WEovTk91"} @@ -1131,13 +1131,13 @@ 00440{"flow_id":161,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1092,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":413140,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ebhAAEAG3vXAqAEiQTffDMORnF\/vfD9kP0r\/xIAYECmPvwAAAQEICj4jMq5Noe23pd7yTaWfPN4="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1093,"source":"skype.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":184,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1093,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":483955,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9kPYAAEARbgbAqAEib91KDDLdnF8AKfx\/nHwCoMStpaQYl8DnkwYEqqAF9FXdbHxKRUYHrOVyJRT4"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1093,"source":"skype.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1093,"source":"skype.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1094,"source":"skype.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40034,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":185,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1094,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":483956,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAc7wAAEARJVPAqAEinTeCnDLdnGIALEvBnH4CZ\/Wwkka3Pn+XJ2UB3JhFKbNG53SJ0IkPRrwOiZA6M572"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1094,"source":"skype.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1094,"source":"skype.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431969685483,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40034,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1095,"source":"skype.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":1,"flow_first_seen":1431969685484,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.31","src_port":13021,"dst_port":40021,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":186,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1095,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":484020,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA72\/8AAEARIuzAqAEib91KHzLdnFUAJxsjnIACakgRW6zNH9umAy\/xnD4EBConFfeCu32RWyeo5A=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1095,"source":"skype.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":1,"flow_first_seen":1431969685484,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.31","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1095,"source":"skype.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":1,"flow_first_seen":1431969685484,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.31","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00458{"flow_id":175,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1096,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":579350,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLzugAAEARKEbAqAEiwKgBAdRHADUAN3UY\/nwBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAABAAE="} 00457{"flow_id":176,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1097,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":579539,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLSKwAAEARroLAqAEiwKgBAeQAADUAN6zvm+wBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAAcAAE="} 00439{"flow_id":101,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1098,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969685,"pkt_ts_usec":656480,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA82+1AADcGhjadN4KWwKgBIpxLw35DcUSZQA26NoAYAB0qhwAAAQEICk63szg+IuZBa1Fa9Z6K\/TI="} @@ -1150,10 +1150,10 @@ 00477{"flow_id":142,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1113,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":488863,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"0NQSxnP1PBXCt3IOCABFAABWXbBAAEAG+1bAqAEinTeCmcOJAbvJCUV1l+7ieIAYECycdwAAAQEICj4jNuBOtN5CdYilVbtaCwK\/tgRArD4Y28szEXDIjTbyD0VdE11jWOuPGA=="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1114,"source":"skype.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.29","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00437{"flow_id":187,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1114,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":494151,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7KdYAAEAR1RfAqAEib91KHTLdnFgAJyRCnIIC1fLHUFbyfUuPJFSEHOCi7XP7hf4fCpbSA7AYcw=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1114,"source":"skype.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.29","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1114,"source":"skype.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.29","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1115,"source":"skype.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.147","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":188,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1115,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":494152,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+wC0AAEAR2OzAqAEinTeCkzLdnFMAKhU5nIQCbtjtgTR5b1SpAOgeT3hZ1sNas6z5WpsHwiEzG2Fdeg=="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1115,"source":"skype.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.147","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1115,"source":"skype.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431969686494,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.147","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_id":174,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1116,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":540994,"pkt_caplen":108,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":108,"pkt_l4_len":74,"pkt":"0NQSxnP1PBXCt3IOCABFAABee+9AAEAGJwnAqAEinTc4oMOVAbs\/vde5DvO1MYAYECy3IQAAAQEICj4jNxRNfpP1C\/K+P2bJpeJPHa2PUHDULtdZf\/0zeGwCQKqXzvyh2rxHpWJ9WEovTk91"} 00439{"flow_id":177,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1117,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":561149,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8KGZAAEAGMKrAqAEinTeCqsOWnFJsNFXh7fFHoYAYECr99AAAAQEICj4jNyhOqgg\/dBFKHGWgP00="} 00497{"flow_id":183,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1118,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969686,"pkt_ts_usec":675317,"pkt_caplen":115,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":115,"pkt_l4_len":81,"pkt":"0NQSxnP1PBXCt3IOCABFAABlvF1AAEAGnInAqAEinTeCqsOYAbvnclDsz\/tu9oAYECxxrgAAAQEICj4jN5pOqgnRdB6rqSY5gTFTXdFTg9Bm\/CX0YSch8t1o2530L+EgrBJRuOnQwGMPQHcj8K4bAGf3WA=="} @@ -1176,13 +1176,13 @@ 00409{"flow_id":64,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1127,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969687,"pkt_ts_usec":310663,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAoAo1AAEAGoJfAqAEinTc4qsN1AbtlArNVAAAAAFAEAAA6rAAA"} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1128,"source":"skype.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00446{"flow_id":193,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1128,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969687,"pkt_ts_usec":504457,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBxOwAAEARHhbAqAEinTc4qDLdnEYALROCnIYCHY\/YUYokwK99l51ViNrnwr9nS0r47IMjMyFmHPRTFPvIVw=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1128,"source":"skype.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1128,"source":"skype.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.168","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1129,"source":"skype.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":194,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1129,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969687,"pkt_ts_usec":504457,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/rI8AAEAR6\/\/AqAEiQTffHTLdnEoAK4\/BnIgC0n2YTtpud4yFT0SZ+E2i0ODhSKmWbVLKl+n0TQ0fOTc="} -00528{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1129,"source":"skype.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1129,"source":"skype.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1130,"source":"skype.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00432{"flow_id":195,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1130,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969687,"pkt_ts_usec":504529,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3NGcAAEAR+6bAqAEinTfrpjLdnE8AI+OWnIoCh50u5xbhS9toIKRfor72\/ZRTG\/Y\/lAII"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1130,"source":"skype.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1130,"source":"skype.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431969687504,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00464{"flow_id":141,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1131,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969687,"pkt_ts_usec":571173,"pkt_caplen":93,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":93,"pkt_l4_len":59,"pkt":"0NQSxnP1PBXCt3IOCABFAABPimVAAEAGGLDAqAEinTc4ksOIAbsXgt5RB+ihfoAYECzEdQAAAQEICj4jOxZNhXLb+CbW3lZbBv40\/beInvTLb7s0B7Su\/nEv8OsV"} 00436{"flow_id":49,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1135,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":11370,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8fZJAAEAGKfvAqAEinTg0LMNwnGCx3l+sHyRlkIAZECn37AAAAQEICj4jPM1MZC+5IVzDseW9I30="} 00425{"flow_id":113,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1136,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":12680,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0DP5AADcGVR6dN4KmwKgBIpxVw4FWpWc92KqiIoARAB0DjwAAAQEICk6sfdE+Iu5A"} @@ -1196,10 +1196,10 @@ 00426{"flow_id":143,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1155,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":514891,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0hDhAAEAGOrXAqAEib91KL8OKAbuRyk1ojMr2RYARECyYHAAAAQEICj4jPsJNhWCp"} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1156,"source":"skype.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":196,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1156,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":514943,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAzhcAAEARLU\/AqAEib91NnzLdnEkALGRznIwCwyeMbMrdlUQ5AFonNJwRLd3E7Awg+gZSbquojb\/nyMcP"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1156,"source":"skype.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1156,"source":"skype.pcap","alias":"nDPId-test","flow_id":196,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1157,"source":"skype.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":197,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1157,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":514944,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4ZaYAAEARmVXAqAEib91KEjLdgQkAJLX6nI4C1Tkw7dXubJLsc4XN4Hhz+Cr0PORpW0nsUg=="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1157,"source":"skype.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1157,"source":"skype.pcap","alias":"nDPId-test","flow_id":197,"flow_packet_id":1,"flow_first_seen":1431969688514,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":144,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1158,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":581627,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8MPRAAEAGjfrAqAEib91KJsOLnE+UB74KG80ZxoAYECnbQAAAAQEICj4jPwRNf6OUySqTc3CS7Ig="} 00467{"flow_id":122,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1159,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":590817,"pkt_caplen":96,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":96,"pkt_l4_len":62,"pkt":"0NQSxnP1PBXCt3IOCABFAABSsw9AAEAGpe7AqAEinTeCpsODAbsS3ITHvVXOp4AZECwupAAAAQEICj4jPw1OrGuYTUkltcFyUDx1UKDVsGVbE\/Ct+3YM+MpJT8qq59Fj"} 00463{"flow_id":143,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1160,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969688,"pkt_ts_usec":614975,"pkt_caplen":91,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":91,"pkt_l4_len":57,"pkt":"0NQSxnP1PBXCt3IOCABFAABN\/MpAAEAGwgnAqAEib91KL8OKAbuRyk1PjMr2RYAZECxaKwAAAQEICj4jPyVNhWCpro9SILG2kEIipiuKXJkgpDduj12IclUwiw=="} @@ -1217,13 +1217,13 @@ 00443{"flow_id":200,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1171,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":470785,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA7khAAEAGAdHAqAEinTfrnMOcnE7UANcqAAAAALAC\/\/9gqgAAAgQFtAEDAwUBAQgKPiNCegAAAAAEAgAA"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1172,"source":"skype.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":201,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1172,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":470958,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6zvgAAEARklXAqAEiQAQXlzLdnF0AJqz9nJAC1zV5OvO9upQBsUXmJpF2nBcsF0HuRy8JJIUg"} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1172,"source":"skype.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1172,"source":"skype.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1173,"source":"skype.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":202,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1173,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":470958,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5rSQAAEARguHAqAEinTfrrDLdnGAAJdphnJIChjRH4yCKz81IO5fkX1qSeV8SZKk7yqqsiNY="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1173,"source":"skype.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1173,"source":"skype.pcap","alias":"nDPId-test","flow_id":202,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1174,"source":"skype.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.152","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":203,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1174,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":470981,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyo54AAEARi\/LAqAEi1cezmDLdnFcAHjAjnJQCZ2daOJDdnSgXIMa0IqUKO\/m6pw=="} -00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1174,"source":"skype.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.152","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1174,"source":"skype.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431969689470,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.152","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":199,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1175,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":525184,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcG+JvVx7OOwKgBIpxDw5sesq08OgI9xqASOJCQMAAAAgQFrAQCCApQDL\/UPiNCegEDAwk="} 00426{"flow_id":199,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1176,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":525261,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0n95AAEAGT8XAqAEi1cezjsObnEM6Aj3GHrKtPYAQECznJAAAAQEICj4jQrBQDL\/U"} 00554{"flow_id":199,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1177,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969689,"pkt_ts_usec":525806,"pkt_caplen":158,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":158,"pkt_l4_len":124,"pkt":"0NQSxnP1PBXCt3IOCABFAACQdIRAAEAGesPAqAEi1cezjsObnEM6Aj3GHrKtPYAYECzznQAAAQEICj4jQrBQDL\/Ub+iEpNZYNceRyGBgSB3fK8wL2sGV8+6y9bK312hvam5FzQRsq5UiP\/Cn1owftehiayARDqcsrfqj+AmmX4QlEtvQAT4X3J0qE6j51s80FUJLgPFuh4yNWoNY6QY="} @@ -1285,10 +1285,10 @@ 00444{"flow_id":204,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1204,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":481458,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAVDVAAEAGBNHAqAEinTeCsMOdnFaE5icqAAAAALAC\/\/\/EvgAAAgQFtAEDAwUBAQgKPiNGZAAAAAAEAgAA"} 00487{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1205,"source":"skype.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":205,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1205,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":481619,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBoHIAAEARwNrAqAEiQAQXkTLdnFgALcyQnJYCZ5BZSWZ\/iXC28\/gJa4xy6SADRNB7IBe6OkY8K1Ib90nh6Q=="} -00527{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1205,"source":"skype.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1205,"source":"skype.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1206,"source":"skype.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00431{"flow_id":206,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1206,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":481620,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2TSkAAEARlefAqAEinTc4pTLdnFQAIg\/nnJgCnGl25qOBTIS5Gpv0M8FAGs9\/YbWac7o="} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1206,"source":"skype.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1206,"source":"skype.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431969690481,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.165","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":200,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1207,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":558595,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ELJAAEAG32vAqAEinTfrnMOcnE7UANd2M6a2f4AYECk34AAAAQEICj4jRrFMWRmSrtaWXBVsqR0="} 00437{"flow_id":204,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1208,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":604504,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYgqdN4KwwKgBIpxWw53yBAwphOYnK6ASOJA8uAAAAgQFrAQCCApOpRObPiNGZAEDAwk="} 00425{"flow_id":204,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1209,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969690,"pkt_ts_usec":604609,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0+KpAAEAGYGfAqAEinTeCsMOdnFaE5icr8gQMKoAQECyTZwAAAQEICj4jRt9OpROb"} @@ -1326,13 +1326,13 @@ 00438{"flow_id":200,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1239,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":484611,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8b19AAEAGgL7AqAEinTfrnMOcnE7UANd2M6a2f4AYECk0SwAAAQEICj4jSkZMWRmSrtaWXBVsqR0="} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1240,"source":"skype.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00425{"flow_id":210,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1240,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":496472,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA03rMAAEARUOLAqAEi1cezkTLdnFsAIONWnJoCpMZAnYkDnzYrDpEHe3Wyl3Fm6DsP"} -00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1240,"source":"skype.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1240,"source":"skype.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1241,"source":"skype.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00429{"flow_id":211,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1241,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":496473,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA38a4AAEARPmXAqAEinTfroDLdnFsAI2YonJwCbYbrE4NbR6JS44ONijeTgTVa37UWYcSt"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"skype.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1241,"source":"skype.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1242,"source":"skype.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":212,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1242,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":496537,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/mMEAAEARl0\/AqAEinTfrmzLdnEMAK8StnJ4Ceg13qBmaNbQ5r3u++QJg+\/7hY4I5I2kK1W2d7qoWGw0="} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1242,"source":"skype.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1242,"source":"skype.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":1,"flow_first_seen":1431969691496,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00461{"flow_id":208,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1243,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":587823,"pkt_caplen":92,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":92,"pkt_l4_len":58,"pkt":"0NQSxnP1PBXCt3IOCABFAABOYSNAAEAGjmbAqAEi1cezjsOfAbt1SdzkHtgDwIAYECwLBgAAAQEICj4jSq1QDMF3EmQmnx6sH6BO82garWUNa027XrMWTbG33jE="} 00505{"flow_id":209,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1244,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":597995,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"0NQSxnP1PBXCt3IOCABFAABr1T9AAEAGGq\/AqAEinTfrnMOgAbv31LYXE02AWoAYECxzMwAAAQEICj4jSrdMWRsjTOTU6C9pwmn1THUzY5b6U80doM\/+81I3Di34csN6MEKT2gWCOGQ+NQDycBffWk+LeTwGvX3Zbg=="} 00457{"flow_id":176,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1245,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969691,"pkt_ts_usec":647552,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLdPMAAEARgjvAqAEiwKgBAeQAADUAN6zvm+wBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDEzAXIFc2t5cGUDbmV0AAAcAAE="} @@ -1352,7 +1352,7 @@ 00438{"flow_id":134,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1260,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969692,"pkt_ts_usec":474566,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA87cNAAEAGa13AqAEinTeCmcOGnEV7WksM7xM3SYAZECjwPwAAAQEICj4jTiFOtNyvZO1SW4ugTYc="} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1261,"source":"skype.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":1,"flow_first_seen":1431969692507,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":214,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1261,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969692,"pkt_ts_usec":507482,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAlm8AAEARZQTAqAEib91NkjLdgQkALPOBnKACf9Ciuj22pCihR6NIjTKXTxwVlkuMzvocVlIJl4RJ8z3V"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1261,"source":"skype.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":1,"flow_first_seen":1431969692507,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1261,"source":"skype.pcap","alias":"nDPId-test","flow_id":214,"flow_packet_id":1,"flow_first_seen":1431969692507,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00439{"flow_id":198,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1262,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969692,"pkt_ts_usec":543720,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8\/u5AAEAGWh7AqAEinTeCrcOanEPZ9QBBKvQZMIAYECpUPQAAAQEICj4jTmZOp72xFzP0mFIZu5U="} 00470{"flow_id":207,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1265,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969692,"pkt_ts_usec":684875,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"0NQSxnP1PBXCt3IOCABFAABUG0JAAEAGPbPAqAEinTeCrcOeAbsMd48zg+uInYAYECyLUwAAAQEICj4jTvJOp79EOIZhDgpM596b5urYTkyt6EokOB\/jfhHHccIbekKWmsc="} 00508{"flow_id":213,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1266,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969692,"pkt_ts_usec":847150,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"0NQSxnP1PBXCt3IOCABFAABuNqxAAEAGIizAqAEinTeCsMOhAbuvVQflSOC7goAYECwnCAAAAQEICj4jT5NOpRVM44Sb+UDZvBPvyND8nEiSDIgGrYJQDfLAHfdrnXRK8kGdb7zASRkE5IOUEx\/7yIb01lebNVn49aeUJw=="} @@ -1439,15 +1439,15 @@ 00439{"flow_id":217,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1349,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":635691,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8SuxAAEAGpTvAqAEinTfrksOogQnO4dIux\/F784AYECr35QAAAQEICj4jZhdMXR0I+8v6kCGg1MM="} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1352,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431969698743,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00450{"flow_id":219,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1352,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":743022,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"0NQSxnP1PBXCt3IOCABFAABEy5wAAEARK5nAqAEiwKgBAfdZADUAMBpr\/I4BAAABAAAAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAQ=="} -00656{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1352,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431969698743,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1352,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431969698743,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00470{"flow_id":219,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1353,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":797139,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"PBXCt3IO0NQSxnP1CABFAABUAABAAEARtyXAqAEBwKgBIgA191kAQKAy\/I6BgAABAAEAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAABAABBfOIaY="} -00682{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1353,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_first_seen":1431969698743,"flow_last_seen":1431969698797,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} +00688{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1353,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_first_seen":1431969698743,"flow_last_seen":1431969698797,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} 00483{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1354,"source":"skype.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_first_seen":1431969698797,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50090,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":220,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1354,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":797752,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABASetAAEAG9Y7AqAEiF84hpsOqAbtGC\/RmAAAAALAC\/\/+XCwAAAgQFtAEDAwUBAQgKPiNmuAAAAAAEAgAA"} 00437{"flow_id":220,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1355,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":840738,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADkGRn4XziGmwKgBIgG7w6oZSGV1Rgv0Z6ASOJDhugAAAgQFrAQCCArsLyLPPiNmuAEDAwU="} 00426{"flow_id":220,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1356,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":840845,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0ZSJAAEAG2mPAqAEiF84hpsOqAbtGC\/RnGUhldoAQECw4twAAAQEICj4jZuLsLyLP"} 00655{"flow_id":220,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1357,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969698,"pkt_ts_usec":841627,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"0NQSxnP1PBXCt3IOCABFAADbDrpAAEAGMCXAqAEiF84hpsOqAbtGC\/RnGUhldoAYECxjgQAAAQEICj4jZuLsLyLPFgMBAKIBAACeAwFVWh+iRxw4dKYdeAHJfyjlXjv9yCDOr6NdIx96jKX10wAATAD\/VgDAJMAjwArACcAIwCjAJ8AUwBPAEsAmwCXABcAEwAPAKsApwA\/ADsANAGsAZwA5ADMAFgA9ADwANQAvAArAB8ARwALADAAFAAQBAAApAAAAEwARAAAOYXBwcy5za3lwZS5jb20ACgAIAAYAFwAYABkACwACAQA="} -00763{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1357,"source":"skype.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":4,"flow_first_seen":1431969698797,"flow_last_seen":1431969698841,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50090,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"apps.skype.com","ja3":"3d49c0a7161d6636fcb6973f14e05046","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00769{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1357,"source":"skype.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":4,"flow_first_seen":1431969698797,"flow_last_seen":1431969698841,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50090,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"apps.skype.com","ja3":"3d49c0a7161d6636fcb6973f14e05046","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1358,"source":"skype.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":1,"flow_first_seen":1431969699142,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50091,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":221,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1358,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969699,"pkt_ts_usec":142169,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAQstAAEAGrVjAqAEinTfrksOrAbuMrH5PAAAAALAC\/\/911AAAAgQFtAEDAwUBAQgKPiNoDgAAAAAEAgAA"} 00655{"flow_id":220,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1359,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969699,"pkt_ts_usec":168503,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"0NQSxnP1PBXCt3IOCABFAADbhlNAAEAGuIvAqAEiF84hpsOqAbtGC\/RnGUhldoAYECxiOwAAAQEICj4jaCjsLyLPFgMBAKIBAACeAwFVWh+iRxw4dKYdeAHJfyjlXjv9yCDOr6NdIx96jKX10wAATAD\/VgDAJMAjwArACcAIwCjAJ8AUwBPAEsAmwCXABcAEwAPAKsApwA\/ADsANAGsAZwA5ADMAFgA9ADwANQAvAArAB8ARwALADAAFAAQBAAApAAAAEwARAAAOYXBwcy5za3lwZS5jb20ACgAIAAYAFwAYABkACwACAQA="} @@ -1720,16 +1720,16 @@ 00418{"flow_id":238,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1667,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":779738,"pkt_caplen":59,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":59,"pkt_l4_len":25,"pkt":"0NQSxnP1PBXCt3IOCABFAAAtqZ1AAEAGmyfAqAEiW77YfcO+MD4D6993vOs\/Q1AYIACvLwAAFgMBAAA="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1669,"source":"skype.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.26.55.167","src_port":13021,"dst_port":63773,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":239,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1669,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":813443,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuRSsAAEARjAjAqAEisBo3pzLd+R0AGvy6nPQCqlUgKb9nOC7NdHVpaZsV"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1669,"source":"skype.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.26.55.167","src_port":13021,"dst_port":63773,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1669,"source":"skype.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.26.55.167","src_port":13021,"dst_port":63773,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1670,"source":"skype.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.185.207.12","src_port":13021,"dst_port":45493,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00418{"flow_id":240,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1670,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":813503,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuxDQAAEAR2PrAqAEiTLnPDDLdsbUAGvt+nPYC2PYYRrvqRJzYx\/ENvQip"} -00529{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1670,"source":"skype.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.185.207.12","src_port":13021,"dst_port":45493,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00535{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1670,"source":"skype.pcap","alias":"nDPId-test","flow_id":240,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.185.207.12","src_port":13021,"dst_port":45493,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1671,"source":"skype.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.97.100.249","src_port":13021,"dst_port":26635,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00418{"flow_id":241,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1671,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":813568,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAu9OEAAEARrrjAqAEisGFk+TLdaAsAGvRlnPgCVJNAf7hukPL\/wXB1U06s"} -00530{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1671,"source":"skype.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.97.100.249","src_port":13021,"dst_port":26635,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1671,"source":"skype.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.97.100.249","src_port":13021,"dst_port":26635,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1672,"source":"skype.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.62.0.85","src_port":13021,"dst_port":33647,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":242,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1672,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":813568,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuQzIAAEARLjDAqAEiRz4AVTLdg28AGnA0nPoCdLBbJLLwvfiy++3Nr6hQ"} -00526{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1672,"source":"skype.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.62.0.85","src_port":13021,"dst_port":33647,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00532{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1672,"source":"skype.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"71.62.0.85","src_port":13021,"dst_port":33647,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431969713814,"flow_last_seen":0,"flow_min_l4_payload_len":165,"flow_max_l4_payload_len":165,"flow_tot_l4_payload_len":165,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00617{"flow_id":243,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":814754,"pkt_caplen":207,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":207,"pkt_l4_len":173,"pkt":"PBXCt3IOxCwDBkn+CABFAADBLbUAAP8R6nbAqAFc4AAA+xTpFOkArSlHAAAAAAAEAAMAAAAAC19hZnBvdmVydGNwBF90Y3AFbG9jYWwAAAyAAQRfc21iwBgADIABBF9yZmLAGAAMgAEGX2FkaXNrwBgADIABwAwADAABAAAPvAAWE0x1Y2HigJlzIE1hY0Jvb2tQcm\/ADMAMAAwAAQAADA4AEA1MdWNh4oCZcyBpTWFjwAzAKAAMAAEAAAwOABANTHVjYeKAmXMgaU1hY8Ao"} 00565{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1673,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431969713814,"flow_last_seen":0,"flow_min_l4_payload_len":165,"flow_max_l4_payload_len":165,"flow_tot_l4_payload_len":165,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","ndpi": {"proto":"MDNS","breed":"Acceptable","category":"Network"},"mdns": {"answer":"_afpovertcp._tcp.local"}} @@ -1739,10 +1739,10 @@ 00417{"flow_id":238,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1675,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":822833,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"PBXCt3IO0NQSxnP1CABFCAAot7tAADYGlwZbvth9wKgBIjA+w7686z9DA+vffFAQA6DimgAAAAAAAAAA"} 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.145","src_port":13021,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00418{"flow_id":245,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":965184,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuO\/8AAEARXS3AqAEinTeCkTLdAbsAGqTTnQwCwP4SRbwMfSMDCWlEQOP1"} -00585{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.145","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00591{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1681,"source":"skype.pcap","alias":"nDPId-test","flow_id":245,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.145","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00486{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1682,"source":"skype.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.39","src_port":13021,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":246,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1682,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969713,"pkt_ts_usec":965185,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuUbAAAEARRubAqAEiQTffJzLdAbsAGjQZnQ4ChKdksriBAZEnlRRV2r4X"} -00583{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1682,"source":"skype.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.39","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00589{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1682,"source":"skype.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":1,"flow_first_seen":1431969713965,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.39","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00417{"flow_id":238,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1690,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969714,"pkt_ts_usec":165130,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"PBXCt3IO0NQSxnP1CABFCAAoe6BAAPUGFCFbvth9wKgBIjA+w7686z9DA+vffFAUJeXAUQAAAAAAAAAA"} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1691,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":1,"flow_first_seen":1431969714165,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":247,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1691,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969714,"pkt_ts_usec":165437,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAXlBAAEAG5mHAqAEiW77YfcO\/AbtO2k10AAAAALAC\/\/\/+rQAAAgQFtAEDAwUBAQgKPiOiXAAAAAAEAgAA"} @@ -2046,10 +2046,10 @@ 00491{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2226,"source":"skype.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":1,"flow_first_seen":1431969713813,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"176.97.100.249","src_port":13021,"dst_port":26635,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2226,"source":"skype.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52742,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":271,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2226,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969720,"pkt_ts_usec":556111,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKnloAAEARWNXAqAEiwKgBAc4GADUANhjrBXkBAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAAAEAAQ=="} -00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2226,"source":"skype.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52742,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst5.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2226,"source":"skype.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52742,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst5.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2227,"source":"skype.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":56387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":272,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2227,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969720,"pkt_ts_usec":556330,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABK65gAAEARC5fAqAEiwKgBAdxDADUANtEePu0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAABwAAQ=="} -00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2227,"source":"skype.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":56387,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst5.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2227,"source":"skype.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431969720556,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":56387,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst5.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00440{"flow_id":252,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2231,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969720,"pkt_ts_usec":848846,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8Ya5AAEAGeGPAqAEiUVNNjcPEROe9aVaB2bol\/oAZEClPQwAAAQEICj4ju9oAupldFs\/7EKwgSC8="} 00416{"flow_id":247,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2235,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969721,"pkt_ts_usec":38439,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":25,"pkt":"PBXCt3IO0NQSxnP1CABFCAAthDRAADYGyohbvth9wKgBIgG7w79kPKOrTtpNelAYA6A0ZwAAFwMBAAAA"} 00410{"flow_id":247,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2236,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969721,"pkt_ts_usec":38558,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAoq1JAAEAGmXfAqAEiW77YfcO\/AbtO2k16ZDyjsFAQH\/8wEwAA"} @@ -2069,10 +2069,10 @@ 00457{"flow_id":272,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2274,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969721,"pkt_ts_usec":596772,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKslEAAEARRN7AqAEiwKgBAdxDADUANtEePu0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAABwAAQ=="} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2276,"source":"skype.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52714,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":273,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2276,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969721,"pkt_ts_usec":954000,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA0TgAAEARJgHAqAEiwKgBAc3qADUALN\/7ZhIBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} -00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2276,"source":"skype.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52714,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2276,"source":"skype.pcap","alias":"nDPId-test","flow_id":273,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52714,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2277,"source":"skype.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51802,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":274,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2277,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969721,"pkt_ts_usec":954245,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAl6MAAEARX5bAqAEiwKgBAcpaADUALFPq9ZgBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} -00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2277,"source":"skype.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51802,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2277,"source":"skype.pcap","alias":"nDPId-test","flow_id":274,"flow_packet_id":1,"flow_first_seen":1431969721954,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51802,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00881{"flow_id":266,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2281,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969722,"pkt_ts_usec":473111,"pkt_caplen":398,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":398,"pkt_l4_len":364,"pkt":"0NQSxnP1PBXCt3IOCABFAAGARphAAEAG\/T\/AqAEiW77YF8POMD6CImX9rdWNC4AYECjvDgAAAQEICj4jwiYNJSaium5jNp\/t6MnvYv17vInE+u60ockfR5mfGTOro0QN8LMKnmAyvODPlTeyrnkoAUpKceu5uu4NlVO\/v7ctJqTBVS8o0R1CSL+EPA5s6N3+\/xSicLOSk8FOw0ZK8JvNsCjaQnMlPLIfYEsiQsmAyX1mhdmutUXuX1FlLSieJ868LDp8KWnZBPAIIPoWEV34j0UNNhg8OjdvwRinNdOManql86rY\/V2GVf6ms8Z9fpiOdcl2TxrxP9aSeZz3HmVMIj+c1\/jv3lQrBoXgfkzaS2fI27xuPVW4vOSfOCqdpBx40nBoPLwgs99WAHdL8kRdgfaFID96DQLsQ1X2UmAKMsqHqhcdQYFDK9h1czYRqgSNf6OjxZjjG\/RON6LXVdAjMLtOT1G4VUncOMp43DgkS1qIRYNmPbrc8XzQI4wvtYSHiTNizbbA6Gpepi0kbFY="} 00457{"flow_id":271,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2284,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969722,"pkt_ts_usec":604608,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABK1+UAAEARH0rAqAEiwKgBAc4GADUANhjrBXkBAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAAAEAAQ=="} 00457{"flow_id":272,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2285,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969722,"pkt_ts_usec":604741,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABK050AAEARI5LAqAEiwKgBAdxDADUANtEePu0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAABwAAQ=="} @@ -2102,10 +2102,10 @@ 00417{"flow_id":240,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2314,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969723,"pkt_ts_usec":864300,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAujeYAAEARD0nAqAEiTLnPDDLdsbUAGk80noICQMd2CkIbTJvr2m+0rjWR"} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2315,"source":"skype.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63421,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":276,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2315,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969723,"pkt_ts_usec":979489,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLQV0AAEARtdHAqAEiwKgBAfe9ADUAN4CxqiYBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAABAAE="} -00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2315,"source":"skype.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63421,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2315,"source":"skype.pcap","alias":"nDPId-test","flow_id":276,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63421,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2316,"source":"skype.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65037,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":277,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2316,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969723,"pkt_ts_usec":979685,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLuaAAAEARPY7AqAEiwKgBAf4NADUANx167A0BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} -00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2316,"source":"skype.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65037,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00670{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2316,"source":"skype.pcap","alias":"nDPId-test","flow_id":277,"flow_packet_id":1,"flow_first_seen":1431969723979,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65037,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00438{"flow_id":275,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2317,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969724,"pkt_ts_usec":58733,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8FntAAEAGhbHAqAEi1KEIJMPSNFCRDXEXwSvNzoAYEChagwAAAQEICj4jyE4\/mk5203B1cONeI20="} 00441{"flow_id":273,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2320,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969724,"pkt_ts_usec":89704,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAyr4AAEARLHvAqAEiwKgBAc3qADUALN\/7ZhIBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} 00440{"flow_id":274,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2321,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969724,"pkt_ts_usec":89826,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAk9AAAEARY2nAqAEiwKgBAcpaADUALFPq9ZgBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} @@ -2232,7 +2232,7 @@ 00994{"flow_id":282,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2527,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969734,"pkt_ts_usec":854265,"pkt_caplen":484,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":484,"pkt_l4_len":450,"pkt":"AQBef\/\/6xCwDBkn+CABFAAHWlOAAAAERcTjAqAFc7\/\/\/+sOkB2wBwvRETk9USUZZICogSFRUUC8xLjENCkhvc3Q6MjM5LjI1NS4yNTUuMjUwOjE5MDANCk5UOnV1aWQ6MmNiYzc4NWUtMjVmNC00MGNhLTk4YjUtMGQ1ODA0YWRhYThlDQpOVFM6c3NkcDphbGl2ZQ0KTG9jYXRpb246aHR0cDovLzEwLjIxMS41NS4zOjI4NjkvdXBucGhvc3QvdWRoaXNhcGkuZGxsP2NvbnRlbnQ9dXVpZDoyY2JjNzg1ZS0yNWY0LTQwY2EtOThiNS0wZDU4MDRhZGFhOGUNClVTTjp1dWlkOjJjYmM3ODVlLTI1ZjQtNDBjYS05OGI1LTBkNTgwNGFkYWE4ZQ0KQ2FjaGUtQ29udHJvbDptYXgtYWdlPTkwMA0KU2VydmVyOk1pY3Jvc29mdC1XaW5kb3dzLU5ULzUuMSBVUG5QLzEuMCBVUG5QLURldmljZS1Ib3N0LzEuMA0KT1BUOiJodHRwOi8vc2NoZW1hcy51cG5wLm9yZy91cG5wLzEvMC8iOyBucz0wMQ0KMDEtTkxTOmQ0NmQ1MDA5ZTE0NzFiYTY4MDBlNDNlN2YwZTEyZWU0DQoNCg=="} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2528,"source":"skype.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":1,"flow_first_seen":1431969735255,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"106.188.249.186","src_port":13021,"dst_port":15120,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00417{"flow_id":283,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2528,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969735,"pkt_ts_usec":255261,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuQGgAAEARFBbAqAEiarz5ujLdOxAAGjrunqMCSv26L3gQtCJn9dl5F8Bv"} -00531{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2528,"source":"skype.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":1,"flow_first_seen":1431969735255,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"106.188.249.186","src_port":13021,"dst_port":15120,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2528,"source":"skype.pcap","alias":"nDPId-test","flow_id":283,"flow_packet_id":1,"flow_first_seen":1431969735255,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"106.188.249.186","src_port":13021,"dst_port":15120,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00457{"flow_id":272,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2543,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969737,"pkt_ts_usec":793099,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKNw8AAEARwCDAqAEiwKgBAdxDADUANtEePu0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAABwAAQ=="} 00457{"flow_id":271,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2544,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969737,"pkt_ts_usec":793236,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKv88AAEARN2DAqAEiwKgBAc4GADUANhjrBXkBAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDUBcgVza3lwZQNuZXQAAAEAAQ=="} 00442{"flow_id":273,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2546,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969739,"pkt_ts_usec":164470,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA88UAAEARA3TAqAEiwKgBAc3qADUALN\/7ZhIBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} @@ -2297,8 +2297,8 @@ 00474{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2660,"source":"skype.pcap","alias":"nDPId-test","flow_id":292,"flow_packet_id":1,"flow_first_seen":1431969751302,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"224.0.0.1","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}} 00599{"flow_id":291,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2671,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969752,"pkt_ts_usec":702036,"pkt_caplen":190,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":190,"pkt_l4_len":156,"pkt":"0NQSxnP1PBXCt3IOCABFAACwh4FAAEAGHpXAqAEinTg1L8PWMD5iE\/U4s4ZWnYAYECnRuwAAAQEICj4kN+BiCpP\/ou083U4OUyKG5W39Rls52kHB4seHtGFWOjnxH9vL96zo7s\/hrhePc7yngjP78uPjgBCPNClMUrhUfbjHZM1vl72+27X8ItWoRr+cMWFEKEXMETqEyhRTKZ3N68tnVQztCI2VGGc5XDXqlMlRkcFBPVHkMJHGNR6XiHbo9Q=="} 00600{"flow_id":291,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2673,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969754,"pkt_ts_usec":301317,"pkt_caplen":190,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":190,"pkt_l4_len":156,"pkt":"0NQSxnP1PBXCt3IOCABFAACw0RhAAEAG1P3AqAEinTg1L8PWMD5iE\/U4s4ZWnYAYECnLfAAAAQEICj4kPh9iCpP\/ou083U4OUyKG5W39Rls52kHB4seHtGFWOjnxH9vL96zo7s\/hrhePc7yngjP78uPjgBCPNClMUrhUfbjHZM1vl72+27X8ItWoRr+cMWFEKEXMETqEyhRTKZ3N68tnVQztCI2VGGc5XDXqlMlRkcFBPVHkMJHGNR6XiHbo9Q=="} -00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2700,"source":"skype.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":255,"flow_first_seen":1431969710853,"flow_last_seen":1431969756218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":79866,"flow_avg_l4_payload_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":50108,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2700,"source":"skype.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":255,"flow_first_seen":1431969710853,"flow_last_seen":1431969756218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":79866,"flow_avg_l4_payload_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":50108,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2700,"source":"skype.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":255,"flow_first_seen":1431969710853,"flow_last_seen":1431969756218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":79866,"flow_avg_l4_payload_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":50108,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2700,"source":"skype.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":255,"flow_first_seen":1431969710853,"flow_last_seen":1431969756218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":79866,"flow_avg_l4_payload_len":313,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":50108,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00601{"flow_id":291,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2725,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969757,"pkt_ts_usec":319046,"pkt_caplen":190,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":190,"pkt_l4_len":156,"pkt":"0NQSxnP1PBXCt3IOCABFAACw99xAAEAGrjnAqAEinTg1L8PWMD5iE\/U4s4ZWnYAYECm\/yAAAAQEICj4kSdNiCpP\/ou083U4OUyKG5W39Rls52kHB4seHtGFWOjnxH9vL96zo7s\/hrhePc7yngjP78uPjgBCPNClMUrhUfbjHZM1vl72+27X8ItWoRr+cMWFEKEXMETqEyhRTKZ3N68tnVQztCI2VGGc5XDXqlMlRkcFBPVHkMJHGNR6XiHbo9Q=="} 00489{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2746,"source":"skype.pcap","alias":"nDPId-test","flow_id":293,"flow_packet_id":1,"flow_first_seen":1431969758516,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"192.168.1.255","src_port":57621,"dst_port":57621,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00462{"flow_id":293,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2746,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969758,"pkt_ts_usec":516437,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"\/\/\/\/\/\/\/\/xCwDBkn+CABFAABIeXwAAEARfH3AqAFcwKgB\/+EV4RUANFGUU3BvdFVkcDB5FYpWEIvHwwABAARIlcIDhMAbG8d8ZX7RWey9o+VAQ2IEJyw="} @@ -2506,7 +2506,7 @@ 00444{"flow_id":314,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3231,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969793,"pkt_ts_usec":781225,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAXRdAAEAGSWvAqAEinTg1M8PiAbsrN9oxAAAAALAC\/\/\/B8AAAAgQFtAEDAwUBAQgKPiTXqwAAAAAEAgAA"} 00484{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":3232,"source":"skype.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_first_seen":1431969793871,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55893,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00433{"flow_id":315,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3232,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969793,"pkt_ts_usec":871150,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA68cwAAEARBXPAqAEiwKgBAdpVADUAJgS+DhkBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} -00646{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3232,"source":"skype.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_first_seen":1431969793871,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55893,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00652{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3232,"source":"skype.pcap","alias":"nDPId-test","flow_id":315,"flow_packet_id":1,"flow_first_seen":1431969793871,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55893,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00444{"flow_id":313,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3233,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969794,"pkt_ts_usec":172396,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAj1lAAEAGFynAqAEinTg1M8PhMD4fbaHhAAAAALAC\/\/\/WAgAAAgQFtAEDAwUBAQgKPiTZMQAAAAAEAgAA"} 00444{"flow_id":314,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3234,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969794,"pkt_ts_usec":784356,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA\/CFAAEAGqmDAqAEinTg1M8PiAbsrN9oxAAAAALAC\/\/++BwAAAgQFtAEDAwUBAQgKPiTblAAAAAAEAgAA"} 00438{"flow_id":295,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3235,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969794,"pkt_ts_usec":907548,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8W2xAAEAGL9jAqAEiTKehBsPXTzInl3b0mo2mjYAZECqpCwAAAQEICj4k3A++obtETjjGVAMHb58="} @@ -2523,15 +2523,15 @@ 00432{"flow_id":315,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3247,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969799,"pkt_ts_usec":18123,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6VP0AAEARokLAqAEiwKgBAdpVADUAJgS+DhkBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} 00443{"flow_id":314,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3248,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969799,"pkt_ts_usec":793474,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAgi9AAEAGJFPAqAEinTg1M8PiAbsrN9oxAAAAALAC\/\/+qewAAAgQFtAEDAwUBAQgKPiTvIAAAAAAEAgAA"} 00433{"flow_id":315,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3250,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969802,"pkt_ts_usec":19013,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6+ugAAEAR\/FbAqAEiwKgBAdpVADUAJgS+DhkBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} -00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969678270,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50033,"dst_port":40015,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969678270,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50033,"dst_port":40015,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969678270,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":63,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50033,"dst_port":40015,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969676525,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":270,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50034,"dst_port":40033,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969676525,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":270,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50034,"dst_port":40033,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":17,"flow_first_seen":1431969657367,"flow_last_seen":1431969676525,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":270,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50034,"dst_port":40033,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":3,"flow_first_seen":1431969675567,"flow_last_seen":1431969675716,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":50024,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Apple","breed":"Safe","category":"Web"}} 00495{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":3,"flow_first_seen":1431969675567,"flow_last_seen":1431969675716,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":1,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"17.172.100.36","src_port":50024,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969678254,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50038,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969678254,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50038,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969678254,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":264,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":50038,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":14,"flow_first_seen":1431969658978,"flow_last_seen":1431969677390,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":396,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":14,"flow_first_seen":1431969658978,"flow_last_seen":1431969677390,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":396,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":14,"flow_first_seen":1431969658978,"flow_last_seen":1431969677390,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":396,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50036,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00423{"flow_id":313,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3251,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969802,"pkt_ts_usec":183087,"pkt_caplen":62,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":62,"pkt_l4_len":28,"pkt":"0NQSxnP1PBXCt3IOCABFAAAwHcFAAEAGiNHAqAEinTg1M8PhMD4fbaHhAAAAAHAC\/\/86fAAAAgQFtAQCAAA="} 00439{"flow_id":308,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3252,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969803,"pkt_ts_usec":191195,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8AztAAEAGRHnAqAEiTsric8PfcYPq0omdOI9v9YAZECprlwAAAQEICj4k\/GUCUMlGXTwVWHHTywE="} @@ -2548,33 +2548,33 @@ 00439{"flow_id":305,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3282,"source":"skype.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431969808,"pkt_ts_usec":684170,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8us9AAEAGP5vAqAEiUA4uecPdET\/5wLpfrY8XW4AZECiq1wAAAQEICj4lEdAAA1guNacy1AseEXM="} 00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":17,"flow_first_seen":1431969704664,"flow_last_seen":1431969723753,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":87,"flow_tot_l4_payload_len":251,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":50098,"dst_port":40026,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":17,"flow_first_seen":1431969704664,"flow_last_seen":1431969723753,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":87,"flow_tot_l4_payload_len":251,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":50098,"dst_port":40026,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":15,"flow_first_seen":1431969665416,"flow_last_seen":1431969685656,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50046,"dst_port":40011,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":15,"flow_first_seen":1431969665416,"flow_last_seen":1431969685656,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50046,"dst_port":40011,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":15,"flow_first_seen":1431969665416,"flow_last_seen":1431969685656,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50046,"dst_port":40011,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969692603,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50054,"dst_port":40005,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969692603,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50054,"dst_port":40005,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969692603,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":106,"flow_tot_l4_payload_len":311,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50054,"dst_port":40005,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":8,"flow_first_seen":1431969642087,"flow_last_seen":1431969695591,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":312,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":52850,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":16,"flow_first_seen":1431969667439,"flow_last_seen":1431969689428,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50049,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":16,"flow_first_seen":1431969667439,"flow_last_seen":1431969689428,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50049,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":16,"flow_first_seen":1431969667439,"flow_last_seen":1431969689428,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50049,"dst_port":40021,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":17,"flow_first_seen":1431969663377,"flow_last_seen":1431969687753,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":223,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50044,"dst_port":40031,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":17,"flow_first_seen":1431969663377,"flow_last_seen":1431969687753,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":223,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50044,"dst_port":40031,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":17,"flow_first_seen":1431969663377,"flow_last_seen":1431969687753,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":223,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50044,"dst_port":40031,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":17,"flow_first_seen":1431969689470,"flow_last_seen":1431969722520,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":76,"flow_tot_l4_payload_len":191,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50074,"dst_port":40003,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":17,"flow_first_seen":1431969689470,"flow_last_seen":1431969722520,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":76,"flow_tot_l4_payload_len":191,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50074,"dst_port":40003,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":17,"flow_first_seen":1431969689470,"flow_last_seen":1431969722520,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":76,"flow_tot_l4_payload_len":191,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50074,"dst_port":40003,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969701671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":225,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50053,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969701671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":225,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50053,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":17,"flow_first_seen":1431969673443,"flow_last_seen":1431969701671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":225,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50053,"dst_port":40030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":7,"flow_first_seen":1431969675950,"flow_last_seen":1431969702405,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":357,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63108,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":17,"flow_first_seen":1431969683498,"flow_last_seen":1431969716234,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50070,"dst_port":40018,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":17,"flow_first_seen":1431969683498,"flow_last_seen":1431969716234,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50070,"dst_port":40018,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":17,"flow_first_seen":1431969683498,"flow_last_seen":1431969716234,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":57,"flow_tot_l4_payload_len":176,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50070,"dst_port":40018,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":18,"flow_first_seen":1431969689470,"flow_last_seen":1431969717232,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":93,"flow_tot_l4_payload_len":240,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50076,"dst_port":40014,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":18,"flow_first_seen":1431969689470,"flow_last_seen":1431969717232,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":93,"flow_tot_l4_payload_len":240,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50076,"dst_port":40014,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":18,"flow_first_seen":1431969689470,"flow_last_seen":1431969717232,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":93,"flow_tot_l4_payload_len":240,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50076,"dst_port":40014,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":17,"flow_first_seen":1431969681480,"flow_last_seen":1431969709213,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":175,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50067,"dst_port":40027,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":17,"flow_first_seen":1431969681480,"flow_last_seen":1431969709213,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":175,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50067,"dst_port":40027,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":17,"flow_first_seen":1431969681480,"flow_last_seen":1431969709213,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":175,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50067,"dst_port":40027,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":17,"flow_first_seen":1431969690481,"flow_last_seen":1431969722726,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":202,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50077,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":17,"flow_first_seen":1431969690481,"flow_last_seen":1431969722726,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":202,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50077,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":17,"flow_first_seen":1431969690481,"flow_last_seen":1431969722726,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":202,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50077,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":17,"flow_first_seen":1431969699577,"flow_last_seen":1431969718631,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50092,"dst_port":40020,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":17,"flow_first_seen":1431969699577,"flow_last_seen":1431969718631,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50092,"dst_port":40020,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":17,"flow_first_seen":1431969699577,"flow_last_seen":1431969718631,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":257,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50092,"dst_port":40020,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":17,"flow_first_seen":1431969658376,"flow_last_seen":1431969684569,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":9,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":50035,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":57,"flow_packet_id":17,"flow_first_seen":1431969658376,"flow_last_seen":1431969684569,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":168,"flow_avg_l4_payload_len":9,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":50035,"dst_port":40021,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":17,"flow_first_seen":1431969704664,"flow_last_seen":1431969722362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":241,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50097,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":17,"flow_first_seen":1431969704664,"flow_last_seen":1431969722362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":241,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50097,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":17,"flow_first_seen":1431969704664,"flow_last_seen":1431969722362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":241,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50097,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00518{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":14,"flow_first_seen":1431969788719,"flow_last_seen":1431969803191,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50143,"dst_port":29059,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":308,"flow_packet_id":14,"flow_first_seen":1431969788719,"flow_last_seen":1431969803191,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":75,"flow_tot_l4_payload_len":188,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"78.202.226.115","src_port":50143,"dst_port":29059,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -2583,7 +2583,7 @@ 00519{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":19,"flow_first_seen":1431969689470,"flow_last_seen":1431969716588,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.142","src_port":50075,"dst_port":40003,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":19,"flow_first_seen":1431969689470,"flow_last_seen":1431969716588,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":227,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.142","src_port":50075,"dst_port":40003,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":2,"flow_first_seen":1431969698743,"flow_last_seen":1431969698797,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63321,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00530{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":16,"flow_first_seen":1431969657367,"flow_last_seen":1431969688218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":236,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50032,"dst_port":40032,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00536{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":16,"flow_first_seen":1431969657367,"flow_last_seen":1431969688218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":236,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50032,"dst_port":40032,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":16,"flow_first_seen":1431969657367,"flow_last_seen":1431969688218,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":236,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":50032,"dst_port":40032,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":149,"flow_packet_id":7,"flow_first_seen":1431969675950,"flow_last_seen":1431969702405,"flow_min_l4_payload_len":51,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":357,"flow_avg_l4_payload_len":51,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55159,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1431969642247,"flow_last_seen":1431969668794,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":217,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":65426,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2610,28 +2610,28 @@ 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":15,"flow_first_seen":1431969714398,"flow_last_seen":1431969727593,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":101,"flow_tot_l4_payload_len":256,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50112,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969794907,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":164,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50135,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":295,"flow_packet_id":14,"flow_first_seen":1431969770694,"flow_last_seen":1431969794907,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":64,"flow_tot_l4_payload_len":164,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50135,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":6,"flow_first_seen":1431969712931,"flow_last_seen":1431969713736,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":111,"flow_tot_l4_payload_len":111,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50109,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":6,"flow_first_seen":1431969712931,"flow_last_seen":1431969713736,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":111,"flow_tot_l4_payload_len":111,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50109,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":6,"flow_first_seen":1431969712931,"flow_last_seen":1431969713736,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":111,"flow_tot_l4_payload_len":111,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50109,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00527{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":6,"flow_first_seen":1431969713736,"flow_last_seen":1431969714165,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50110,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":6,"flow_first_seen":1431969713736,"flow_last_seen":1431969714165,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50110,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":6,"flow_first_seen":1431969713736,"flow_last_seen":1431969714165,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50110,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00511{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_first_seen":1431969774806,"flow_last_seen":1431969776480,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50140,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00496{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":300,"flow_packet_id":3,"flow_first_seen":1431969774806,"flow_last_seen":1431969776480,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":50140,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":10,"flow_first_seen":1431969717949,"flow_last_seen":1431969723488,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50125,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":10,"flow_first_seen":1431969717949,"flow_last_seen":1431969723488,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50125,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":265,"flow_packet_id":10,"flow_first_seen":1431969717949,"flow_last_seen":1431969723488,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":112,"flow_tot_l4_payload_len":181,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50125,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":332,"flow_tot_l4_payload_len":3826,"flow_avg_l4_payload_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":332,"flow_tot_l4_payload_len":3826,"flow_avg_l4_payload_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431969717949,"flow_last_seen":1431969750910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":332,"flow_tot_l4_payload_len":3826,"flow_avg_l4_payload_len":191,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.23","src_port":50126,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":270,"flow_packet_id":10,"flow_first_seen":1431969719561,"flow_last_seen":1431969727878,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":50129,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":7,"flow_first_seen":1431969643972,"flow_last_seen":1431969670410,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57726,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":8,"flow_first_seen":1431969642087,"flow_last_seen":1431969695591,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":312,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55711,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":14,"flow_first_seen":1431969675056,"flow_last_seen":1431969702873,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":276,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50058,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":14,"flow_first_seen":1431969675056,"flow_last_seen":1431969702873,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":276,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50058,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":14,"flow_first_seen":1431969675056,"flow_last_seen":1431969702873,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":276,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50058,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":13,"flow_first_seen":1431969677018,"flow_last_seen":1431969694645,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":421,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50063,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":13,"flow_first_seen":1431969677018,"flow_last_seen":1431969694645,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":421,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50063,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":13,"flow_first_seen":1431969677018,"flow_last_seen":1431969694645,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":421,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50063,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":4,"flow_first_seen":1431969713814,"flow_last_seen":1431969726846,"flow_min_l4_payload_len":165,"flow_max_l4_payload_len":165,"flow_tot_l4_payload_len":660,"flow_avg_l4_payload_len":165,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"224.0.0.251","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":12,"flow_first_seen":1431969697097,"flow_last_seen":1431969714913,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":307,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50087,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":12,"flow_first_seen":1431969697097,"flow_last_seen":1431969714913,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":307,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50087,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":12,"flow_first_seen":1431969697097,"flow_last_seen":1431969714913,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":307,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50087,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":13,"flow_first_seen":1431969706277,"flow_last_seen":1431969719939,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50100,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":13,"flow_first_seen":1431969706277,"flow_last_seen":1431969719939,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50100,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":228,"flow_packet_id":13,"flow_first_seen":1431969706277,"flow_last_seen":1431969719939,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":243,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50100,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":282,"flow_packet_id":14,"flow_first_seen":1431969728749,"flow_last_seen":1431969734854,"flow_min_l4_payload_len":433,"flow_max_l4_payload_len":513,"flow_tot_l4_payload_len":6693,"flow_avg_l4_payload_len":478,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"239.255.255.250","src_port":50084,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":17,"flow_first_seen":1431969643093,"flow_last_seen":1431969698671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":2405,"flow_avg_l4_payload_len":141,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":50029,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -2661,7 +2661,7 @@ 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":7,"flow_first_seen":1431969642337,"flow_last_seen":1431969668794,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":238,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49793,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":285,"flow_packet_id":2,"flow_first_seen":1431969745776,"flow_last_seen":1431969745776,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":265,"flow_avg_l4_payload_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":64560,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431969643037,"flow_last_seen":1431969643092,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51879,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00535{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":20,"flow_first_seen":1431969714165,"flow_last_seen":1431969745160,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":20,"flow_first_seen":1431969714165,"flow_last_seen":1431969745160,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":247,"flow_packet_id":20,"flow_first_seen":1431969714165,"flow_last_seen":1431969745160,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":327,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":50111,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":9,"flow_first_seen":1431969642969,"flow_last_seen":1431969723490,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":270,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49903,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":252,"flow_packet_id":19,"flow_first_seen":1431969714902,"flow_last_seen":1431969731550,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":96,"flow_tot_l4_payload_len":260,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":50116,"dst_port":17639,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} @@ -2676,7 +2676,7 @@ 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":7,"flow_first_seen":1431969642398,"flow_last_seen":1431969668794,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49990,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00516{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":16,"flow_first_seen":1431969705713,"flow_last_seen":1431969723790,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":108,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":50099,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":16,"flow_first_seen":1431969705713,"flow_last_seen":1431969723790,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":108,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":50099,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":18,"flow_first_seen":1431969697530,"flow_last_seen":1431969725781,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50088,"dst_port":33033,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":18,"flow_first_seen":1431969697530,"flow_last_seen":1431969725781,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50088,"dst_port":33033,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":18,"flow_first_seen":1431969697530,"flow_last_seen":1431969725781,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50088,"dst_port":33033,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":7,"flow_first_seen":1431969643971,"flow_last_seen":1431969670410,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60288,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":15,"flow_first_seen":1431969681060,"flow_last_seen":1431969700978,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":454,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.12","src_port":50066,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} @@ -2688,58 +2688,58 @@ 00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":14,"flow_first_seen":1431969706277,"flow_last_seen":1431969717910,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":458,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":50102,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00511{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":7,"flow_first_seen":1431969792168,"flow_last_seen":1431969802183,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50145,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":313,"flow_packet_id":7,"flow_first_seen":1431969792168,"flow_last_seen":1431969802183,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.53.51","src_port":50145,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969687310,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50037,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969687310,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50037,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":15,"flow_first_seen":1431969658979,"flow_last_seen":1431969687310,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":50037,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":15,"flow_first_seen":1431969664990,"flow_last_seen":1431969683864,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":413,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50045,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":15,"flow_first_seen":1431969664990,"flow_last_seen":1431969683864,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":413,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50045,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":15,"flow_first_seen":1431969664990,"flow_last_seen":1431969683864,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":413,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":50045,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":15,"flow_first_seen":1431969667019,"flow_last_seen":1431969685356,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":347,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50048,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":15,"flow_first_seen":1431969667019,"flow_last_seen":1431969685356,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":347,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50048,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":15,"flow_first_seen":1431969667019,"flow_last_seen":1431969685356,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":347,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":50048,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":15,"flow_first_seen":1431969669039,"flow_last_seen":1431969688720,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":353,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50051,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":15,"flow_first_seen":1431969669039,"flow_last_seen":1431969688720,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":353,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50051,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":15,"flow_first_seen":1431969669039,"flow_last_seen":1431969688720,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":353,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.166","src_port":50051,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969696024,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":261,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50056,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969696024,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":261,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50056,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969696024,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":261,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":50056,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969694153,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":351,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50057,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969694153,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":351,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50057,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":15,"flow_first_seen":1431969675055,"flow_last_seen":1431969694153,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":351,"flow_avg_l4_payload_len":23,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.153","src_port":50057,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":18,"flow_first_seen":1431969714398,"flow_last_seen":1431969731992,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":202,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50114,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":18,"flow_first_seen":1431969714398,"flow_last_seen":1431969731992,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":60,"flow_tot_l4_payload_len":202,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50114,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00520{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":31,"flow_first_seen":1431969715511,"flow_last_seen":1431969755484,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2618,"flow_avg_l4_payload_len":84,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50118,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00505{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":31,"flow_first_seen":1431969715511,"flow_last_seen":1431969755484,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2618,"flow_avg_l4_payload_len":84,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50118,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":174,"flow_packet_id":15,"flow_first_seen":1431969683081,"flow_last_seen":1431969710648,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":403,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50069,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":174,"flow_packet_id":15,"flow_first_seen":1431969683081,"flow_last_seen":1431969710648,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":403,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50069,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":174,"flow_packet_id":15,"flow_first_seen":1431969683081,"flow_last_seen":1431969710648,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":403,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.160","src_port":50069,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":15,"flow_first_seen":1431969685111,"flow_last_seen":1431969703010,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":486,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50072,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":15,"flow_first_seen":1431969685111,"flow_last_seen":1431969703010,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":486,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50072,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":15,"flow_first_seen":1431969685111,"flow_last_seen":1431969703010,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":486,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":50072,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":268,"flow_packet_id":2,"flow_first_seen":1431969719055,"flow_last_seen":1431969719110,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":150,"flow_avg_l4_payload_len":75,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62454,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969709588,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":326,"flow_avg_l4_payload_len":21,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50078,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969709588,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":326,"flow_avg_l4_payload_len":21,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50078,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969709588,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":326,"flow_avg_l4_payload_len":21,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":50078,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969708230,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":536,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50080,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969708230,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":536,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50080,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":15,"flow_first_seen":1431969691076,"flow_last_seen":1431969708230,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":536,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":50080,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":15,"flow_first_seen":1431969692087,"flow_last_seen":1431969710209,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":515,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50081,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":15,"flow_first_seen":1431969692087,"flow_last_seen":1431969710209,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":515,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50081,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":15,"flow_first_seen":1431969692087,"flow_last_seen":1431969710209,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":515,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":50081,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00517{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":18,"flow_first_seen":1431969770694,"flow_last_seen":1431969788429,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":82,"flow_tot_l4_payload_len":245,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50137,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":297,"flow_packet_id":18,"flow_first_seen":1431969770694,"flow_last_seen":1431969788429,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":82,"flow_tot_l4_payload_len":245,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50137,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":7,"flow_first_seen":1431969683445,"flow_last_seen":1431969709776,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58368,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00521{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":23,"flow_first_seen":1431969771806,"flow_last_seen":1431969808841,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2577,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50139,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":299,"flow_packet_id":23,"flow_first_seen":1431969771806,"flow_last_seen":1431969808841,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2577,"flow_avg_l4_payload_len":112,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":50139,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":16,"flow_first_seen":1431969699142,"flow_last_seen":1431969728419,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":684,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50091,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":16,"flow_first_seen":1431969699142,"flow_last_seen":1431969728419,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":684,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50091,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":16,"flow_first_seen":1431969699142,"flow_last_seen":1431969728419,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":684,"flow_avg_l4_payload_len":42,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":50091,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":15,"flow_first_seen":1431969701181,"flow_last_seen":1431969719738,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":308,"flow_avg_l4_payload_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50094,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":15,"flow_first_seen":1431969701181,"flow_last_seen":1431969719738,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":308,"flow_avg_l4_payload_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50094,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":223,"flow_packet_id":15,"flow_first_seen":1431969701181,"flow_last_seen":1431969719738,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":308,"flow_avg_l4_payload_len":20,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.155","src_port":50094,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00521{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":16,"flow_first_seen":1431969659988,"flow_last_seen":1431969685175,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":522,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":50039,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":16,"flow_first_seen":1431969659988,"flow_last_seen":1431969685175,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":522,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":50039,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00534{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":15,"flow_first_seen":1431969706277,"flow_last_seen":1431969723613,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":592,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50101,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":15,"flow_first_seen":1431969706277,"flow_last_seen":1431969723613,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":592,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50101,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":15,"flow_first_seen":1431969706277,"flow_last_seen":1431969723613,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":592,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":50101,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00522{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":16,"flow_first_seen":1431969691076,"flow_last_seen":1431969717999,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":306,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.142","src_port":50079,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":16,"flow_first_seen":1431969691076,"flow_last_seen":1431969717999,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":306,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.142","src_port":50079,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":7,"flow_first_seen":1431969720556,"flow_last_seen":1431969746803,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":56387,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":7,"flow_first_seen":1431969683445,"flow_last_seen":1431969709776,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54343,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":16,"flow_first_seen":1431969675413,"flow_last_seen":1431969703766,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":172,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50059,"dst_port":40015,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":16,"flow_first_seen":1431969675413,"flow_last_seen":1431969703766,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":172,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50059,"dst_port":40015,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":16,"flow_first_seen":1431969675413,"flow_last_seen":1431969703766,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":172,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":50059,"dst_port":40015,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":16,"flow_first_seen":1431969673443,"flow_last_seen":1431969701528,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50055,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":16,"flow_first_seen":1431969673443,"flow_last_seen":1431969701528,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50055,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":16,"flow_first_seen":1431969673443,"flow_last_seen":1431969701528,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":198,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.47","src_port":50055,"dst_port":40030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":7,"flow_first_seen":1431969677975,"flow_last_seen":1431969704363,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58458,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00532{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":16,"flow_first_seen":1431969695483,"flow_last_seen":1431969723584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":83,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50086,"dst_port":40023,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":16,"flow_first_seen":1431969695483,"flow_last_seen":1431969723584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":83,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50086,"dst_port":40023,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":16,"flow_first_seen":1431969695483,"flow_last_seen":1431969723584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":83,"flow_tot_l4_payload_len":206,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":50086,"dst_port":40023,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":15,"flow_first_seen":1431969704663,"flow_last_seen":1431969718237,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50096,"dst_port":40027,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00537{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":15,"flow_first_seen":1431969704663,"flow_last_seen":1431969718237,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50096,"dst_port":40027,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":15,"flow_first_seen":1431969704663,"flow_last_seen":1431969718237,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":62,"flow_tot_l4_payload_len":214,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":50096,"dst_port":40027,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00496{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":7,"flow_first_seen":1431969642244,"flow_last_seen":1431969668794,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":217,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":54396,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":3284,"source":"skype.pcap","alias":"nDPId-test","flow_id":284,"flow_packet_id":2,"flow_first_seen":1431969745776,"flow_last_seen":1431969745776,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":265,"flow_avg_l4_payload_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":56886,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} diff --git a/test/results/skype_no_unknown.pcap.out b/test/results/skype_no_unknown.pcap.out index 266edeb35..63c7ca3d0 100644 --- a/test/results/skype_no_unknown.pcap.out +++ b/test/results/skype_no_unknown.pcap.out @@ -4,25 +4,25 @@ 00483{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":3,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1431970632290,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.219","dst_ip":"224.0.0.22","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":4,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55028,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":2,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":276297,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAj1gAAEARZ+HAqAEiwKgBAdb0ADUALMTUeDABAAABAAAAAAAAAWEGY29uZmlnBXNreXBlA2NvbQAAAQAB"} -00658{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55028,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":4,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55028,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":5,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64971,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":3,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":276471,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAlRoAAEARYh\/AqAEiwKgBAf3LADUALKDXdTsBAAABAAAAAAAAAWEGY29uZmlnBXNreXBlA2NvbQAAHAAB"} -00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64971,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00665{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":5,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":3,"flow_packet_id":1,"flow_first_seen":1431970634276,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64971,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"a.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":6,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431970634431,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60688,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":4,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":6,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":431836,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDXEcAAEARmu\/AqAEiwKgBAe0QADUAL\/kqxMsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} -00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431970634431,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60688,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":6,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":4,"flow_packet_id":1,"flow_first_seen":1431970634431,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60688,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":7,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431970634432,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58631,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":5,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":7,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":432009,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDrh8AAEARSRfAqAEiwKgBAeUHADUAL+4jvNsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} -00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431970634432,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":7,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":5,"flow_packet_id":1,"flow_first_seen":1431970634432,"flow_last_seen":0,"flow_min_l4_payload_len":39,"flow_max_l4_payload_len":39,"flow_tot_l4_payload_len":39,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":58631,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"conn.skype.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":8,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431970634589,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64240,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":6,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":8,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":589949,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7UlwAAEARpOLAqAEiwKgBAfrwADUAJ8Zq760BAAABAAAAAAAAA2FwaQVza3lwZQNjb20AAAEAAQ=="} -00653{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431970634589,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64240,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":8,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":1,"flow_first_seen":1431970634589,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64240,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":9,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431970634591,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49864,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":7,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":9,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":591842,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA75y8AAEAREA\/AqAEiwKgBAcLIADUAJ6plKNsBAAABAAAAAAAAA2FwaQVza3lwZQNjb20AABwAAQ=="} -00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431970634591,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49864,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":9,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":1,"flow_first_seen":1431970634591,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49864,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"api.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":10,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1431970634648,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61016,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":8,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":10,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":648740,"pkt_caplen":80,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":80,"pkt_l4_len":46,"pkt":"0NQSxnP1PBXCt3IOCABFAABCEa4AAEAR5YnAqAEiwKgBAe5YADUALntuuqkBAAABAAAAAAAABGFwcHMLc2t5cGVhc3NldHMDY29tAAABAAE="} -00661{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1431970634648,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61016,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"apps.skypeassets.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":10,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":8,"flow_packet_id":1,"flow_first_seen":1431970634648,"flow_last_seen":0,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":38,"flow_tot_l4_payload_len":38,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61016,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"apps.skypeassets.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":11,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1431970634669,"flow_last_seen":0,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":59,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57694,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00483{"flow_id":9,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":11,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":669345,"pkt_caplen":101,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":101,"pkt_l4_len":67,"pkt":"0NQSxnP1PBXCt3IOCABFAABXFu0AAEAR4DXAqAEiwKgBAeFeADUAQ\/HxjTUBAAABAAAAAAAADkRCM01TR1I1MDExNzA5B2dhdGV3YXkJbWVzc2VuZ2VyBGxpdmUDY29tAAAcAAE="} 00680{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":11,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":1,"flow_first_seen":1431970634669,"flow_last_seen":0,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":59,"flow_tot_l4_payload_len":59,"flow_avg_l4_payload_len":59,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57694,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS","breed":"Acceptable","category":"Network"},"dns": {"query":"db3msgr5011709.gateway.messenger.live.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -32,18 +32,18 @@ 00451{"flow_id":10,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":13,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":728684,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABADqBAAEAGmPnAqAEinTg0HMgdnEkK2QRYAAAAALAC\/\/9q8wAAAgQFtAEDAwUBAQgKPjGHIQAAAAAEAgAA"} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":14,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431970634728,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62875,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":11,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":14,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":728986,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/L\/oAAEARx0DAqAEiwKgBAfWbADUAK9VUuF8BAAABAAAAAAAABWRzbjEzAWQFc2t5cGUDbmV0AAABAAE="} -00659{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431970634728,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62875,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn13.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00665{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":14,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1431970634728,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":62875,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn13.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":15,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1431970634729,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59113,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00450{"flow_id":12,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":15,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":729529,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/lFMAAEARYufAqAEiwKgBAebpADUAK335A20BAAABAAAAAAAABWRzbjEzAWQFc2t5cGUDbmV0AAAcAAE="} -00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1431970634729,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59113,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn13.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00666{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":15,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1431970634729,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59113,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"dsn13.d.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":16,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1431970634729,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":51230,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":13,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":16,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":729598,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAt4dAAEAGpVrAqAEinTh+08geAbsxSRU0AAAAALAC\/\/+DfQAAAgQFtAEDAwUBAQgKPjGHIQAAAAAEAgAA"} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":17,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431970634730,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57592,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00465{"flow_id":14,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":17,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":730943,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLIWAAAEAR1c7AqAEiwKgBAeD4ADUANz9NJ5kBAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDExAXIFc2t5cGUDbmV0AAABAAE="} -00671{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":17,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431970634730,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57592,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst11.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00677{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":17,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":1,"flow_first_seen":1431970634730,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57592,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst11.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":18,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1431970634731,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":53372,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00466{"flow_id":15,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":18,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":731075,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABL+hcAAEAR\/RbAqAEiwKgBAdB8ADUAN25j7f4BAAABAAAAAAAAAzMzNQEwATcBNwEzBXJzdDExAXIFc2t5cGUDbmV0AAAcAAE="} -00672{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1431970634731,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":53372,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst11.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00678{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":18,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":1,"flow_first_seen":1431970634731,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":53372,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst11.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00441{"flow_id":13,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":19,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":805200,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"PBXCt3IO0NQSxnP1CABFAAA4BUNAAHYGIaedOH7TwKgBIgG7yB4Nim5XMUkVNZASIABVdAAAAgQFrAQCCAoZLZ4CPjGHIQ=="} 00436{"flow_id":13,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":20,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":805262,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0\/VlAAEAGX5TAqAEinTh+08geAbsxSRU1DYpuWIAQ\/\/+P3gAAAQEICj4xh20ZLZ4C"} 00566{"flow_id":13,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":21,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":832794,"pkt_caplen":160,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":160,"pkt_l4_len":126,"pkt":"0NQSxnP1PBXCt3IOCABFAACSvDJAAEAGoF3AqAEinTh+08geAbsxSRU1DYpuWIAY\/\/9YPAAAAQEICj4xh4gZLZ4CFgMBAFkBAABVAwF2gnUJnVCWWbyDtFIDg6B8bhQi3kG6KGexUdynVrU4nwAALsAKwAXACcAEwAfAAsAIwAPAFMAPwBPADsARwAzAEsANADkAMwA1AC8ABQAEAAoBAA=="} @@ -56,7 +56,7 @@ 00560{"flow_id":10,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":27,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":934601,"pkt_caplen":157,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":157,"pkt_l4_len":123,"pkt":"0NQSxnP1PBXCt3IOCABFAACPS55AAEAGW6zAqAEinTg0HMgdnEkK2QRZ7hN5uoAYECyExgAAAQEICj4xh+xMX+pXEDaxqNNs94bJX3MjOodsEDM88DACObmxILHLguZFB4dasZ4qWIC3URykkoTC6unHwssAce4HDA3aA9hphr9khfI7sGEed7z9CnOIWbYvFHUiq2BRTuds7TrjOA=="} 02383{"flow_id":13,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":28,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":989841,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"PBXCt3IO0NQSxnP1CABFAAXUCkVAAHYGFwmdOH7TwKgBIgG7yB4NinQMMUkVk4AQ\/SANZgAAAQEIChktnhQ+MYfZUYsZAArswT+sVYDe4\/s+octFa5f5NraUxxncYJ0H1DXox59A2Fq5VISuVN85wP2CCUyU9Jri0W12MS8UHhofDtCC\/aeGWq+l6J+nD16R4eDapUlNB52CJOmfvVeyYhEr\/aSkyh+x5qntiHPmxNL4oQ4t9q9cRGg37NGw4W3v7gKUqZA7GOEtfs7ndzQKvfITYRFhRXtB+Geyc8SVWiWlBbePlt40Z9Mwm7DPu0JToThROvr07EpvaNHsDj+sfl4\/ssqhJPAoVfz0wWGwi\/ByYUJT0t+8BVptm\/HAUYoi\/0PQFRMfymq9Y999sgymNr6YwPYzcm66fQL57hVd+E\/NpGuAwv\/j4I98bfIb7cS26RkUtr41mvTduUpwXz6HZnONvg3rFQ55MtL0jpv\/5T2PNTkmAFhF5Csuvsme4bvtShQRBEmXn48raUgx6y\/5XH7Pm2hyngLVzMnjf+Ej0KsCBNhIlshCh7AABeUwggXhMIIEyaADAgECAgQHJ6pHMA0GCSqGSIb3DQEBCwUAMFoxCzAJBgNVBAYTAklFMRIwEAYDVQQKEwlCYWx0aW1vcmUxEzARBgNVBAsTCkN5YmVyVHJ1c3QxIjAgBgNVBAMTGUJhbHRpbW9yZSBDeWJlclRydXN0IFJvb3QwHhcNMTQwNTA3MTcwNDA5WhcNMTgwNTA3MTcwMzMwWjCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEVMBMGA1UECxMMTWljcm9zb2Z0IElUMR4wHAYDVQQDExVNaWNyb3NvZnQgSVQgU1NMIFNIQTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDR6DendopwSxnwIDcJJDd\/6vt45gW6aq1OJw38cmrZbCHEZBGVcxAKXCV7iGyUBP3H26573EoIsz4W8dCt2zBt1xoeUrU98EcZA+J9pr1XEz9U6jqjsXf8QvBjSWqRgC4wScCK6yuv\/jrrB10G9+n9hA6RvQkgKehuXQnOFdPn79tQ60TvGFerBB28Mfn3eyoTz9E9Ua8bxbV757D8U7ua52PeQTO2RyRpXbhGp\/+tq99PenglJyEmNMoCbjdR8O1YGmCU9sST2N0wJCXXHOsZlDVdk7KuqimDc8R0WQVSZ53aZ1E5BTo26vIedisUruw9+RSZiwduvOcMVt6svq7bdTKQnmO9dL\/gCsr4NJZnhM3RQjh4x5m2DM62D+kby\/RZvhEOyywyyPqDKWR5PItL8DJ0bPOTuJZrXVdaaMHMDHmKGd71SQJeCIABiQwyzdLWltVLoPPsv6v0fbOhuXzaTtflt6y58iVfAcuMlqgorsEzWvY\/CJDc6\/852CbIEp0cmqqpwBaOhu1nUpYAfw2SPT3ZcDbl6kJvH66V5Vtd+NA6x9Ted4bQ\/J5O4uK4qWg3CcQ544W4ifMfbrdtH0ovGAlv3koBjxTJt6bup2OfM6RUfEKDaLil37\/suRpdEzvZrWj9IApVkSFk+dcTAaAIXVmJG0SvpKzHBRD6QUqo+wIDAQABo4IBezCCAXcwEgYDVR0TAQH\/BAgwBgEB\/wIBADBgBgNVHSAEWTBXMEgGCSsGAQQBsT4BADA7MDkGCCsGAQUFBwIBFi1odHRwOi8vY3liZXJ0cnVzdC5vbW5pcm9vdC5jb20vcmVwb3NpdG9yeS5jZm0wCwYJKwYBBAGCNyoBMEIGCCsGAQUFBwEBBDYwNDAyBggrBgEFBQcwAYYmaHR0cDovL29jc3Aub21uaXJvb3QuY29tL2JhbHRpbW9yZXJvb3QwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUF"} 01516{"flow_id":13,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":29,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":990634,"pkt_caplen":864,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":864,"pkt_l4_len":830,"pkt":"PBXCt3IO0NQSxnP1CABFAANSCkZAAHYGGYqdOH7TwKgBIgG7yB4NinmsMUkVk4AY\/SBQngAAAQEIChktnhQ+MYfZBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NkcDEucHVibGljLXRydXN0LmNvbS9DUkwvT21uaXJvb3QyMDI1LmNybDAdBgNVHQ4EFgQUUa8kJpz0aCJXgCYrO0ZiFXsezKUwDQYJKoZIhvcNAQELBQADggEBAGli9oSRAMRvgnsk4UKipYuCXKfFRMvnUnZj03aeeOJpNbE4urCWxh+se8ayZXeLfY2uZLmljBfKWGXDrYL1xaL1AROTxn5E5cRh+gO2VsFy4cgoxWkhj6xu\/X9Dgza4wNagKP4aRb79k4yNpGR5HxTboZ8h3MBOexciF7G2PNOb4gqjfpmwwazY9IbfPNp9FJxAwXzSGG\/xTyZFCZWUXNrQmPj0TIKWEN6sMMsrrvmS6r95A\/weP6wJpD9l\/ZFPliSnzrROapYpF67AqN8XIvQX49wcOQZWEOrqtXQXPE7dfpEKqAt4B6cxRAgxqxiEDxKc596ELOltk0W\/qME\/NNwMAAFnAwAYYQTTN3+FNDwR9eQeYOtvGQZc+LyhevxS5+nlWdkwyQdoN8m1+2TrSW23TxxjbLbMZoXA+i+E6BgARpsJXZy4miOppb32qv9x1t203eD1ERk7k5Ne4\/vHdrClQby6SNFwJX8BAAl\/ijfHVX974KM6wxLtSAfJWttdJMe9phrgwFSWtGSLSkLj7JTk0LOh5eeCvEEKc4XyfO+z9QBr3NsQn+vRBXoi+ZRFdXLZuvlXGipZ\/ucfqfIHMXWjrHlXR\/LFLQ+XNzDn0xc5\/t+\/ZMdGuYxw0VImAhbjPejldJMh0hc4Qzp2SS0NTHC7fcQ2uR09eM6n6MWSLps2XhBpK1q\/8vPqNVAHTu5Iv6lpl++ND07Oxbi1BzAbCIjaCYOj1\/uDcOROeE+gjITbkOPynUa5ZqLz\/1LFziPCTlq8mC2+jxz2G855lLj0tgGab1j1m+m8pMnwqwxJ8XNN3IxLbO1GF2fXdkkOAAAA"} -01206{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":29,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":9,"flow_first_seen":1431970634729,"flow_last_seen":1431970634990,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3792,"flow_avg_l4_payload_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":51230,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.gateway.messenger.live.com,*.beta.gateway.edge.messenger.live.com,*.by2.gateway.edge.messenger.live.com,*.sn1.gateway.edge.messenger.live.com","ja3":"06207a1730b5deeb207b0556e102ded2","ja3s":"5e4e5596180ebd0ac0317125ee490707","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2","issuerDN":"CN=*.gateway.messenger.live.com","fingerprint":"95:C4:07:41:85:D4:EF:AA:D9:1F:0F:1F:3C:08:BF:8E:8B:D0:90:51"}} +01212{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":29,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":9,"flow_first_seen":1431970634729,"flow_last_seen":1431970634990,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":3792,"flow_avg_l4_payload_len":421,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":51230,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"","server_names":"*.gateway.messenger.live.com,*.beta.gateway.edge.messenger.live.com,*.by2.gateway.edge.messenger.live.com,*.sn1.gateway.edge.messenger.live.com","ja3":"06207a1730b5deeb207b0556e102ded2","ja3s":"5e4e5596180ebd0ac0317125ee490707","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT SSL SHA2","issuerDN":"CN=*.gateway.messenger.live.com","fingerprint":"95:C4:07:41:85:D4:EF:AA:D9:1F:0F:1F:3C:08:BF:8E:8B:D0:90:51"}} 00436{"flow_id":13,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":30,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970634,"pkt_ts_usec":990686,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0tBlAAEAGqNTAqAEinTh+08geAbsxSRWTDYp8yoAQ\/\/+ARgAAAQEICj4xiCMZLZ4U"} 00581{"flow_id":13,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":31,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":6082,"pkt_caplen":173,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":173,"pkt_l4_len":139,"pkt":"0NQSxnP1PBXCt3IOCABFAACfFfJAAEAGRpHAqAEinTh+08geAbsxSRWTDYp8yoAY\/\/8YnwAAAQEICj4xiDMZLZ4UFgMBAGYQAABiYQSrq03YfHFl820bvS6W0Qg6ooFgejoxhjE8+5PigHKrLNmVczXJQCrkQ4zH0r4Tyq5CcJvbEQQ6XgJDw4iF3in7mO06MpCaUPpZUq2g8z5yNwkoaNsdB2jO9aO23OTlK6Y="} 00433{"flow_id":10,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":32,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":140069,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0kzBAADMGIXWdODQcwKgBIpxJyB3uE3m6CtkEtIAQAB0KtwAAAQEICkxf6oo+MYfs"} @@ -67,16 +67,16 @@ 00519{"flow_id":13,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":37,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":292905,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":125,"pkt_l4_len":91,"pkt":"0NQSxnP1PBXCt3IOCABFAABv\/ThAAEAGX3rAqAEinTh+08geAbsxSRX+DYp8yoAY\/\/9rIgAAAQEICj4xiVAZLZ4zFAMBAAEBFgMBADBQZqpRu3lF7RSGvtBgMw1mSnNGu4DvBvveLkv5kkOygzRoC+lc04nMGjZN3fCN3gs="} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":38,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431970635325,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":16,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":38,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":325136,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA657QAAEARD4vAqAEiwKgBAfgaADUAJptGWcsBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} -00654{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431970635325,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63514,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":38,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":1,"flow_first_seen":1431970635325,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63514,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"ui.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00518{"flow_id":13,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":39,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":367533,"pkt_caplen":125,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":125,"pkt_l4_len":91,"pkt":"PBXCt3IO0NQSxnP1CABFAABvF85AAHYGDuWdOH7TwKgBIgG7yB4NinzKMUkWOYAY\/Ho6CgAAAQEIChktnjk+MYlQFAMBAAEBFgMBADAE6Vbf2ar\/mJLYKulsBWZHlkQ4OKZ3utTO4lzLpQZ4uuQKcuuOHkCvyMCCR6EuLpw="} 00436{"flow_id":13,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":40,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":367607,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0w0pAAEAGmaPAqAEinTh+08geAbsxSRY5DYp9BYAQ\/\/99yQAAAQEICj4xiZoZLZ45"} 00449{"flow_id":2,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":42,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":375402,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA4MoAAEARFm\/AqAEiwKgBAdb0ADUALMTUeDABAAABAAAAAAAAAWEGY29uZmlnBXNreXBlA2NvbQAAAQAB"} 00448{"flow_id":3,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":43,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":375527,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAWkkAAEARnPDAqAEiwKgBAf3LADUALKDXdTsBAAABAAAAAAAAAWEGY29uZmlnBXNreXBlA2NvbQAAHAAB"} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":44,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431970635433,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":17,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":44,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":433165,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"0NQSxnP1PBXCt3IOCABFAABECpEAAEAR7KTAqAEiwKgBAfitADUAMI+fhgYBAAABAAAAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAQ=="} -00664{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":44,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431970635433,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00670{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":44,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":1,"flow_first_seen":1431970635433,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00477{"flow_id":17,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":48,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":489303,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"PBXCt3IO0NQSxnP1CABFAABUAABAAEARtyXAqAEBwKgBIgA1+K0AQBV0hgaBgAABAAEAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAAMABBfOIaY="} -00690{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":48,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431970635433,"flow_last_seen":1431970635489,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} +00696{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":48,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431970635433,"flow_last_seen":1431970635489,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} 00491{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":49,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1431970635489,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51231,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":49,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":489934,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAPS1AAEAGAk3AqAEiF84hpsgfAbv4Tz2XAAAAALAC\/\/9zuAAAAgQFtAEDAwUBAQgKPjGKEwAAAAAEAgAA"} 00452{"flow_id":5,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":50,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":531097,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDdt0AAEARgFnAqAEiwKgBAeUHADUAL+4jvNsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} @@ -84,7 +84,7 @@ 00445{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":52,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":534408,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADkGRn4XziGmwKgBIgG7yB8YNTxd+E89mKASOJCdjgAAAgQFrAQCCArsPW3FPjGKEwEDAwU="} 00434{"flow_id":18,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":53,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":534489,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0P2xAAEAGABrAqAEiF84hpsgfAbv4Tz2YGDU8XoAQECz0iAAAAQEICj4xij\/sPW3F"} 00688{"flow_id":18,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":54,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":535479,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADta4RAAEAG00jAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECwtoAAAAQEICj4xikDsPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} -00779{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":54,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1431970635489,"flow_last_seen":1431970635535,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51231,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skype.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00785{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":54,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":4,"flow_first_seen":1431970635489,"flow_last_seen":1431970635535,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":185,"flow_tot_l4_payload_len":185,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51231,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"apps.skype.com","ja3":"799135475da362592a4be9199d258726","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00444{"flow_id":6,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":58,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":681147,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA762oAAEARC9TAqAEiwKgBAfrwADUAJ8Zq760BAAABAAAAAAAAA2FwaQVza3lwZQNjb20AAAEAAQ=="} 00445{"flow_id":7,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":59,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":681276,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7\/zoAAEAR+APAqAEiwKgBAcLIADUAJ6plKNsBAAABAAAAAAAAA2FwaQVza3lwZQNjb20AABwAAQ=="} 00450{"flow_id":11,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":65,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970635,"pkt_ts_usec":827854,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/rmUAAEARSNXAqAEiwKgBAfWbADUAK9VUuF8BAAABAAAAAAAABWRzbjEzAWQFc2t5cGUDbmV0AAABAAE="} @@ -100,10 +100,10 @@ 00433{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":84,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970636,"pkt_ts_usec":261075,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0QB5AADEGlbcRj6CVwKgBIhRnxOfKLqurIALxboAQAQqiwwAAAQEIClVX3qQ+MYw5"} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":87,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431970636300,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":50055,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00466{"flow_id":20,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":87,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970636,"pkt_ts_usec":300980,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLV\/cAAEARnzfAqAEiwKgBAcOHADUANwqgVG4BAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAABAAE="} -00671{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":87,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431970636300,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":50055,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00677{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":87,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":1,"flow_first_seen":1431970636300,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":50055,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00492{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":88,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431970636301,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51753,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00465{"flow_id":21,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":88,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970636,"pkt_ts_usec":301275,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLvh0AAEARORHAqAEiwKgBAcopADUAN1kA5GsBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} -00672{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431970636301,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51753,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00678{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":88,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":1,"flow_first_seen":1431970636301,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51753,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00490{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":94,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1431970636340,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":94,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970636,"pkt_ts_usec":340726,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAozBAAEAGBGnAqAEinTg0HMggAbskulgsAAAAALAC\/\/+RjgAAAgQFtAEDAwUBAQgKPjGNXAAAAAAEAgAA"} 00688{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":95,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970636,"pkt_ts_usec":342517,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADt1GlAAEAGamPAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECwqgwAAAQEICj4xjV3sPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} @@ -229,57 +229,57 @@ 00466{"flow_id":21,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":516,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970644,"pkt_ts_usec":547740,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLkaoAAEARZYTAqAEiwKgBAcopADUAN1kA5GsBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":517,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431970644777,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":33,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":517,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970644,"pkt_ts_usec":777198,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+iz0AAEARV8bAqAEinTc4qjLdnE8AKqlOercCgeG1zG2vbzPj0KjKJlzB46QihppHpHZWBMh9hdX\/8Q=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431970644777,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":517,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":1,"flow_first_seen":1431970644777,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.170","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":518,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":34,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":518,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970645,"pkt_ts_usec":790194,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA533AAAEARH43AqAEib91KDzLdnFoAJRqBerkCLcYyzYQBZ1UUv9afmdL8U47Y0EMKk9GOcm8="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":518,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":34,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.15","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":519,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00446{"flow_id":35,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":519,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970645,"pkt_ts_usec":790194,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8IE0AAEAReEHAqAEiQTffITLdnEIAKKkPersC6xhZmoz4NcwgQN8Oq77mdsG6aJAJEzSI01rU6ec="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":519,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":35,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":520,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":36,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":520,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970645,"pkt_ts_usec":790377,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7MzsAAEARLhjAqAEiQAQXkTLdnFsAJ6Pner0C2KbUw2DxbMk3cWJigGAv5JrHPRhWYHrZrKFH\/Q=="} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":520,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":520,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":36,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.145","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":521,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40028,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":37,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":521,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970645,"pkt_ts_usec":790378,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+dlAAAEARIrjAqAEinTeCpTLdnFwAKmyyer8CyymJmKIvjgybbxj4QUGrEeWW\/O+vVrSV+3Rj4Yjh8w=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":521,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":521,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":37,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.165","src_port":13021,"dst_port":40028,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":522,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":38,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":522,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970645,"pkt_ts_usec":790378,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6yaYAAEARHe\/AqAEinTg0GzLdnFkAJhz6esECVdgpKZUPSYYd3u6m4rCVVtMoL0MGJKJcpPJg"} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":522,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":522,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":38,"flow_packet_id":1,"flow_first_seen":1431970645790,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.27","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00730{"flow_id":19,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":523,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":526093,"pkt_caplen":279,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":279,"pkt_l4_len":245,"pkt":"PBXCt3IO0NQSxnP1CABFAAEJQB9AADEGlOERj6CVwKgBIhRnxOfKLqurIALxboAYAQqNlQAAAQEIClVYBlc+MYw5FwMBANBBPnYQ3MvLTtMYdbz0\/DlZYXrEXIv2\/rH+drT1aX9evssLuVRMDl3QSMVQ5mEY0\/AMVWIBvH6FB7+VLmLzLBAlApwIR\/pgZ8dHNQ+FR9uDZJv8y\/k81NO6WrgsBaMbre5mHzeJJa\/1PvYSNghTDfU7tyJC\/BuhouOcubsp78rR9\/PeoVc8nRc15q6ePgewOeEXV7cwouwXYH5r22PZtMDOfowJ3WUbhMyTHrhhLUTwNC6TLywCmXjGJCy\/vKgI21C6KbUoV5dQmUZJn5EWFr7D"} 00435{"flow_id":19,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":524,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":526191,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA04y5AAEAG46bAqAEiEY+glcTnFGcgAvFuyi6sgIAQD\/lCpAAAAQEICj4xtOFVWAZX"} 00558{"flow_id":19,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":525,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":528090,"pkt_caplen":156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":156,"pkt_l4_len":122,"pkt":"0NQSxnP1PBXCt3IOCABFAACOcKNAAEAGVdjAqAEiEY+glcTnFGcgAvFuyi6sgIAYEAD3WAAAAQEICj4xtOJVWAZXFwMBACDuYk2bwgTyOXwC51MmgFGi2ZbfVRwCbzRfkIv9V7lkERcDAQAwIXJA9A7j3DEsaoI+VAhi19LwoM0S0IRXaTeOOjxSOxnOIy\/Lo5axDlu3HMFCyqNA"} 00434{"flow_id":19,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":542,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":741540,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0QCBAADEGlbURj6CVwKgBIhRnxOfKLqyAIALxyIAQAQpP+gAAAQEIClVYB5U+MbTi"} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":543,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.34","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":39,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":543,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":799914,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7AJsAAEAR\/k3AqAEib91KIjLdnFsAJ+15esMC4VlNRvu3By\/5s5rGR+P6LgoKPKR7nd4t4OfW1A=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":543,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.34","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":543,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":39,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.34","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":544,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.168","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":40,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":544,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":799914,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/TKMAAEAR42DAqAEinTfrqDLdnFgAKzONesUCSrWxfzMM\/u+ve5H0njBV7f1MGIL\/NDrkYJJdktuSF9Y="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":544,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.168","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":544,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":40,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.168","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":545,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":41,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":545,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":799986,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5mqYAAEARlXzAqAEinTfrjzLdnF4AJa4yescCvwHYJJA0SDNaHmIGriSDO5fklPid0RnUmyQ="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":545,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":545,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":41,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.143","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":546,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":42,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":546,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":799987,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1cmsAAEARiRbAqAEib91NjzLdnFYAIbzweskC5JgrRdKtWjAuXzT2S5r85LjjhllfqQ=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":546,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":546,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":42,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.143","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":547,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":43,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":547,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970646,"pkt_ts_usec":799987,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA42pAAAEARJFHAqAEib91KLDLdnFMAJIhoessC81Jpsjijfp0Q\/Q0jMgS+1lTSx5HXr8lZjQ=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":547,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":547,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":43,"flow_packet_id":1,"flow_first_seen":1431970646799,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.44","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00478{"flow_id":22,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":548,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":110720,"pkt_caplen":94,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":94,"pkt_l4_len":60,"pkt":"0NQSxnP1PBXCt3IOCABFAABQmndAAEAGDRLAqAEinTg0HMggAbskulh14+mZNYAYECyiagAAAQEICj4xtydMX+wkj\/+\/FJjGnvuHRd2oWYqGsDWb1go6xLS\/RXUyPQ=="} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":562,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.173","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":44,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":562,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":810412,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6zV0AAEARYhbAqAEi1cezrTLdnE0AJlZnes0Ccg7v+3Lfid3osaqIFpFm\/v4o\/QqgzaHMxbGQ"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":562,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.173","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":562,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":44,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.173","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":563,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.167","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":45,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":563,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":810413,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1vrcAAEARJFjAqAEinTc4pzLdnFgAIREees8CCCEtcEeglQLd7mhp21iK7rcni5fedw=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":563,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.167","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":563,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":45,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.167","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":564,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00446{"flow_id":46,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":564,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":810480,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9vysAAEARohHAqAEiQAQXpTLdnEQAKTALetECX1BVIaBDDxsr7kKWybF1ggh0MeIv40Hl0rhawj9H"} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":564,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":564,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":46,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":565,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":47,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":565,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":810480,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4G6EAAEARfQHAqAEiQTffETLdnFkAJOrWetMCvMga3ljFR4ptkQ1XTBYwQJAI0\/6MTBVdPQ=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":565,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":565,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":47,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.17","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":566,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":48,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":566,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970647,"pkt_ts_usec":810480,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1FVUAAEARg0\/AqAEiQTffEjLdgQkAIczZetUCcHkMN3GT\/RrB0G0KocMuGJme8meMAw=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":566,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":566,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":48,"flow_packet_id":1,"flow_first_seen":1431970647810,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00503{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":567,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1431970648367,"flow_last_seen":0,"flow_min_l4_payload_len":291,"flow_max_l4_payload_len":291,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":291,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"239.255.255.250","src_port":1025,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00801{"flow_id":49,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":567,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":367692,"pkt_caplen":333,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":333,"pkt_l4_len":299,"pkt":"AQBef\/\/6oPPBbTu2CABFAAE\/BH4AAAQR\/4\/AqAD+7\/\/\/+gQBB2wBK+71Tk9USUZZICogSFRUUC8xLjENCkhPU1Q6IDIzOS4yNTUuMjU1LjI1MDoxOTAwDQpDQUNIRS1DT05UUk9MOiBtYXgtYWdlPTEwMA0KTE9DQVRJT046IGh0dHA6Ly8xOTIuMTY4LjAuMjU0OjE5MDAvaWdkLnhtbA0KTlQ6IHVwbnA6cm9vdGRldmljZQ0KTlRTOiBzc2RwOmFsaXZlDQpTRVJWRVI6IFRQLUxJTksgV2lyZWxlc3MgTiBOYW5vIFJvdXRlciBXUjcwMk4sIFVQblAvMS4wDQpVU046IHV1aWQ6dXBucC1JbnRlcm5ldEdhdGV3YXlEZXZpY2UtMTkyMTY4MDI1NDc4OTAwMDAxOjp1cG5wOnJvb3RkZXZpY2UNCg0K"} 00534{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":567,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":49,"flow_packet_id":1,"flow_first_seen":1431970648367,"flow_last_seen":0,"flow_min_l4_payload_len":291,"flow_max_l4_payload_len":291,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":291,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"239.255.255.250","src_port":1025,"dst_port":1900,"l4_proto":"udp","ndpi": {"proto":"SSDP","breed":"Acceptable","category":"System"}} @@ -294,19 +294,19 @@ 00880{"flow_id":49,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":576,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":471824,"pkt_caplen":393,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":393,"pkt_l4_len":359,"pkt":"AQBef\/\/6oPPBbTu2CABFAAF7BIcAAAQR\/0rAqAD+7\/\/\/+gQBB2wBZ2gITk9USUZZICogSFRUUC8xLjENCkhPU1Q6IDIzOS4yNTUuMjU1LjI1MDoxOTAwDQpDQUNIRS1DT05UUk9MOiBtYXgtYWdlPTEwMA0KTE9DQVRJT046IGh0dHA6Ly8xOTIuMTY4LjAuMjU0OjE5MDAvaWdkLnhtbA0KTlQ6IHVybjpzY2hlbWFzLXVwbnAtb3JnOnNlcnZpY2U6V0FOSVBDb25uZWN0aW9uOjENCk5UUzogc3NkcDphbGl2ZQ0KU0VSVkVSOiBUUC1MSU5LIFdpcmVsZXNzIE4gTmFubyBSb3V0ZXIgV1I3MDJOLCBVUG5QLzEuMA0KVVNOOiB1dWlkOnVwbnAtV0FOQ29ubmVjdGlvbkRldmljZS0xOTIxNjgwMjU0Nzg5MDAwMDE6OnVybjpzY2hlbWFzLXVwbnAtb3JnOnNlcnZpY2U6V0FOSVBDb25uZWN0aW9uOjENCg0K"} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":589,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.32","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":50,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":589,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":822506,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/tTsAAEAR41DAqAEiQTffIDLdnFYAK5o2etcCQsTVfNgeznDqGm3ssKnJOluDwQd072c+I4wlse7Ecr8="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":589,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.32","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":589,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":50,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.32","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":590,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":51,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":590,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":822569,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+1vAAAEARJ\/bAqAEib91KITLdnEsAKklketkCS\/KCvZwmcOx3xDmHrpkfhUG8CXubM92mElOOFhZFlQ=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":590,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":590,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":51,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.33","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":591,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40008,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":52,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":591,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":822569,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6md0AAEARSUPAqAEinTc4kTLdnEgAJsmIetsCpJOMytcJAiTHtz9O4hYGu7tAbRVxbii4hHFE"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":591,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":591,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":52,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.145","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":592,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":53,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":592,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":822569,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5n+IAAEAR+MLAqAEiQTffDTLdnEkAJdiCet0C1RhCM\/VIp+W5EaRfz2WprIWREBw71gUfrFc="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":592,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":592,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":53,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":593,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.19","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":54,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":593,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":822579,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA29EUAAEAR81vAqAEinTg0EzLdnFQAIrQSet8CIfzcSNY9VVu6zPT0+wzX1iqsIu28Tro="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":593,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.19","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":593,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":54,"flow_packet_id":1,"flow_first_seen":1431970648822,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.19","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00504{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":594,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1431970648880,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01091{"flow_id":55,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":594,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970648,"pkt_ts_usec":880273,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"\/\/\/\/\/\/\/\/PBXCt3IOCABFAAISCYEAAEARrZDAqAEi\/\/\/\/\/0RcRFwB\/vqceyJob3N0X2ludCI6IDE1NzMxOTU0NDUsICJ2ZXJzaW9uIjogWzEsIDhdLCAiZGlzcGxheW5hbWUiOiAiIiwgInBvcnQiOiAxNzUwMCwgIm5hbWVzcGFjZXMiOiBbMTQ4MTkzMzcsIDE3NjA5OTYzLCAyMDY0OTM0OSwgMjg1MjE2MDcsIDU4MzQ0OTk2LCA2MDU5NDk4MywgNjQ0MzYwOTksIDk2ODUzMjI0LCA5OTQ2OTc3MywgMTAxMDQ3OTk2LCAxMDgxNTkxMDIsIDEyNTU0MDU2NiwgMTc2OTY0MzA3LCAyNDM2ODI5ODYsIDI0NzkyNTA4NSwgMjYwNDY1MjYxLCAyNzA0MDQ3NDIsIDI4Mzg2MTQ1NywgNDI0NTQwMTk3LCA0NDgzOTczOTMsIDQ1MTQ3MjY1OCwgNTExNzA2NjQyLCA1NjgzOTU4MzMsIDU5NDI0Njk1NCwgNTk4MDYxMDY2LCA2MTU5ODMzNzksIDcyMDA1ODM2MSwgNzM1MDUxODMwLCA3MzYzNDE1MjgsIDc0MTI1NTYxMywgNzc2MDg3MjQ3LCA3ODA4NzA1ODEsIDc4Mjk4MTk0OSwgNzg1MjY2MTc3LCA4MTg3NTI3MTAsIDg1NTY4MjM5MCwgODg0MTIwMTMyLCA5MDg5MTQ4NjhdfQ=="} 00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":594,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":55,"flow_packet_id":1,"flow_first_seen":1431970648880,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -327,19 +327,19 @@ 00452{"flow_id":61,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":603,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":777696,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABATBhAAEAGcsvAqAEib91KLcgknEjYMAm6AAAAALAC\/\/91FQAAAgQFtAEDAwUBAQgKPjHBiQAAAAAEAgAA"} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":604,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.171","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":62,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":604,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":777888,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5i9YAAEARDTHAqAEinTeCqzLdnEwAJdiNeuEC3c6rdtKsOez6ZXpeJVa7dJ779QK3\/h1JCUU="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":604,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.171","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":604,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.171","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":605,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.65","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":63,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":605,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":777963,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4dm4AAEARIgTAqAEiQTffQTLdgQkAJKmFeuMCyKqN77xeuXZwH4mCRZ2EnuTirQv1Yiuj0A=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":605,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.65","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":605,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.65","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":606,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":64,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":606,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":777964,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4qTUAAEARhmHAqAEi1cezjDLdnEMAJE+IeuUC57gN1FWjl+cH4OXx7LBzSKM5WN7Ui1CRpw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":606,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":606,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":607,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.39","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":65,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":607,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":777990,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAx6cAAEARH9zAqAEinTg0JzLdnF8ALF\/teucC9OsZNQfegPGKe6bjID0chTfhFg98J57+zrR\/SJSxjuh7"} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":607,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.39","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":607,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":65,"flow_packet_id":1,"flow_first_seen":1431970649777,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.39","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":608,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431970649778,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.25","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":66,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":608,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":778021,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+a34AAEARfBXAqAEinTg0GTLdnEoAKvPOeukCU4Ora98LBiEx3upKt3C\/idNCTbgKHnJdEXlx5pIWdA=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":608,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431970649778,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.25","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":608,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":66,"flow_packet_id":1,"flow_first_seen":1431970649778,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.25","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00435{"flow_id":10,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":618,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":834167,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0NmVAAEAGcUDAqAEinTg0HMgdnEkK2QS87hN6BYARECnAggAAAQEICj4xwcBMX+qK"} 00435{"flow_id":22,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":619,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":834168,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0nplAAEAGCQzAqAEinTg0HMggAbskuliR4+mZNYARECzWtAAAAQEICj4xwcBMX+wk"} 00446{"flow_id":59,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":620,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970649,"pkt_ts_usec":858177,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADYG+iadN+uTwKgBIpxByCKHTehVD6e9gKASOJCRTQAAAgQFrAQCCApMYEY4PjHBiQEDAwk="} @@ -370,19 +370,19 @@ 00453{"flow_id":67,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":644,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":785836,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAQ6lAAEAGFV3AqAEinTeCsMglnFZwrI8vAAAAALAC\/\/\/tTwAAAgQFtAEDAwUBAQgKPjHFcQAAAAAEAgAA"} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":645,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":68,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":645,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":786156,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ax0AAEARLXbAqAEiQTffHDLdnE4AKA\/ueusCO4\/2IMsd1vZVtYtrG4KJHI0MKaf\/zYcpuYfyCTg="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":645,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":645,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":68,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.28","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":646,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":69,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":646,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":786157,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA02DgAAEARwOTAqAEinTeCmjLdnE0AIDT4eu0C9+f6EdNHv7hYXHZqXAueiqwkwiBF"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":646,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":646,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":69,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.154","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":647,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":70,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":647,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":786177,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+20MAAEARvT3AqAEiQTffLDLdnFQAKsWAeu8CRodfDjWwQgXB9ThlvK8WB1Z6kJ0K1lKVKQH1\/lgrJA=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":647,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":647,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":70,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.44","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":648,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":71,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":648,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":786305,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA++5AAAEARZaPAqAEiQAQXrTLdnFEAKkiDevECuUkWpyPJriCjpMdyVTxdl5EcBPkRY6\/lJZGF7hytnA=="} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":648,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":648,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":71,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.173","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":649,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":72,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":649,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":786315,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA\/bcAAEARMcnAqAEi1cezmjLdnFEALEFuevMCLFThLGMqgdMtKoErvKHNoLTdO9PKUomxAAk6+9gobSzp"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":649,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":649,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":72,"flow_packet_id":1,"flow_first_seen":1431970650786,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00446{"flow_id":67,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":650,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":909954,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGYgqdN4KwwKgBIpxWyCXC803gcKyPMKASOJCo1gAAAgQFrAQCCApOqL1kPjHFcQEDAwk="} 00435{"flow_id":67,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":651,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":910057,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0eB9AAEAG4PLAqAEinTeCsMglnFZwrI8wwvNN4YAQECz\/hAAAAQEICj4xxe1OqL1k"} 00508{"flow_id":67,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":652,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970650,"pkt_ts_usec":910605,"pkt_caplen":118,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":118,"pkt_l4_len":84,"pkt":"0NQSxnP1PBXCt3IOCABFAABoLuFAAEAGKf3AqAEinTeCsMglnFZwrI8wwvNN4YAYECw4GgAAAQEICj4xxe1OqL1kQDBPNYAQZj8RkGWwccFpRJKeMgR0hR6+94lop5uzmYWORKswp70IIqGKetrWefi+S4Dxbg=="} @@ -418,19 +418,19 @@ 00453{"flow_id":5,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":679,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":802490,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDFisAAEAR4QvAqAEiwKgBAeUHADUAL+4jvNsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":680,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":76,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":680,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":850367,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9fnAAAEARsRvAqAEi1cezkjLdgQkAKdgxevUC7H9CpX1vDFjUgifamALKVmn9IG\/Fgz6DNfXKD8OP"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":680,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":680,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":76,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":681,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.160","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":77,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":681,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":850367,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/x4wAAEARZ+\/AqAEi1cezoDLdnF4AKxOyevcCGvABkprWeh8EUhOC0BCTnmpfRyuj2xsq6jfI1V+MUC4="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":681,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.160","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":681,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":77,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.160","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":682,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":78,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":682,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":850367,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1mAEAAEART6jAqAEinTg0DDLdnF8AIfBgevkCw9fuW226FZ\/i0VkBrMngLZ\/OvlepsQ=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":682,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":682,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":78,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.12","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":683,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":79,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":683,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":850440,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAT+gAAEAREWjAqAEiQAQXjzLdnFIALKj4evsCuV\/AUAbJFwXr2TpK\/p9BHGpZ+kg1tywBGmcFc5l3l+UA"} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":683,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":683,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":79,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":684,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.174","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":80,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":684,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":850441,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5DD0AAEARIzfAqAEi1cezrjLdnFkAJTHjev0CDsFSgVTjU3l7SB\/6pLcIO\/MFhUO5HKYdIt4="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":684,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.174","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":684,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":80,"flow_packet_id":1,"flow_first_seen":1431970651850,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.174","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00513{"flow_id":73,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":685,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":868482,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"0NQSxnP1PBXCt3IOCABFAABsOfhAAEAGtf7AqAEinTfrk8gmAbvxz5zEZu7sLYAYECxFrAAAAQEICj4xyaVMYEfZsJPOrYWxbQ2kS5GoHYZTSJUEAhUVjQ9Suc6gMln7jVEiXtQHYU+2Wg9JNG\/SECNBnGag8RNJ4KY="} 00448{"flow_id":59,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":686,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":950739,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8WcBAAEAGlmbAqAEinTfrk8ginEEPp73th03onYAYECk3\/QAAAQEICj4xyfdMYEZOu98xvI+OKgs="} 00434{"flow_id":75,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":687,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970651,"pkt_ts_usec":972533,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0BRlAADYGw9Zv3UotwKgBIgG7yCgNTasMSHrP+4AQAB1dYgAAAQEICk2HrhU+Mcjn"} @@ -500,19 +500,19 @@ 00442{"flow_id":16,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":706,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":702673,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6qdwAAEARTWPAqAEiwKgBAfgaADUAJptGWcsBAAABAAAAAAAAAnVpBXNreXBlA2NvbQAAAQAB"} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":707,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":82,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":707,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":859729,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyWSMAAEARpePAqAEib91KDTLdnEkAHvqKev8C0IwzOBgB3UEKOkJTX5CI9Vwhwg=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":707,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":82,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.13","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":708,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":83,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":708,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":859729,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1DNUAAEAR8g3AqAEib91KLjLdnFsAIUKoewECUhceSedyogxjoY07gc663Yk4liOtLw=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":708,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":708,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":83,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.46","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":709,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.174","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":84,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":709,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":859801,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6I1wAAEARDKfAqAEinTfrrjLdnFMAJnmaewMCB1Y35rB9hiYgpWTMLw7QXUk3fDnH35+GDlnt"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":709,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.174","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":709,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":84,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.174","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":710,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.22","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00446{"flow_id":85,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":710,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":859801,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8IkgAAEARdlHAqAEiQTffFjLdnEkAKNsyewUCeMezn62nslRHzPMr8rZBDWA5jghU5oMMawkbl98="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":710,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.22","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":710,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":85,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.22","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":711,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":86,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":711,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":859801,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2CdUAAEAR8anAqAEib91NkTLdnFgAIo9yewcCvaqOUinZ3k4PRY4yBX99xmfLU0z2qZs="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":711,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":711,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":86,"flow_packet_id":1,"flow_first_seen":1431970652859,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":60,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":712,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970652,"pkt_ts_usec":922001,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8Cw9AAEAGTX7AqAEiQTffLcgjnEma5hzvzyelXIAYECkVaAAAAQEICj4xzb1NlOiwwc7xhOCNCBA="} 00520{"flow_id":74,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":713,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":12042,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"0NQSxnP1PBXCt3IOCABFAABxrEtAAEAGrAzAqAEiQTffLcgnAbvOrma7ApkXD4AYECxxUQAAAQEICj4xzhZNlOpApvNYMEQS5cpK5u6346cd8BL2N20dvzqenZJMFcn1yRtBVTFQ\/i2ToNXpC7XoSTbRK6UPDCtXBWtUo6jCxA=="} 00530{"flow_id":81,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":714,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":151309,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB3wFhAAEAGmHbAqAEinTeCsMgpAbtXW5OVu\/PiI4AYECwleQAAAQEICj4xzqFOqL8U9IDgvpwdzGcEkd9CX4txidHNl7imFBAwZtm7PgDORMBSjaYWMXjPRWAjyRyC8GW2MJh6wHE92aXcM+JRSsWm\/1CudQ=="} @@ -525,37 +525,37 @@ 00448{"flow_id":67,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":721,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":821331,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8XLdAAEAG\/FLAqAEinTeCsMglnFZwrI9kwvNOL4AYECnJfAAAAQEICj4x0T5OqL2E+DHKQRbsUKg="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":722,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":13021,"dst_port":40007,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":87,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":722,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":869214,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA54bUAAEARt2bAqAEinTeCljLdnEcAJaaFewkCIUNJcqobuUolNpafXbellV+EM\/ULmpysjyw="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":722,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":87,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.150","src_port":13021,"dst_port":40007,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":723,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":88,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":723,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":869214,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBP+oAAEARp7DAqAEinTg0DzLdnFsALYwJewsCVNeDMJHHK\/Dt9HVlBuPPBbINu9bDjb8MSpCCrsrjyd0TEg=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":723,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":723,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":88,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.15","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":724,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.162","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":89,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":724,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":869278,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0mUYAAEARls7AqAEinTfrojLdnGEAICOXew0CZW2\/4VtO8SUcLK6ApfNDe+uaEMsE"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":724,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.162","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":724,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":89,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.162","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":725,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":90,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":725,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":869278,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6nacAAEARXcXAqAEib91NnzLdnF8AJrQGew8Ci4JWnsKyT6r3gHVnkQ4+dXrvzbvknlDqGmE\/"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":725,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":725,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":90,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.159","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":726,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":91,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":726,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":869279,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABB8NoAAEARcG\/AqAEiQAQXlDLdnF0ALRa1exECrGOk9zKZhpR5Z4LrruV\/92iAsqS9CAawX8X4D80kRASy7Q=="} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":726,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":726,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":91,"flow_packet_id":1,"flow_first_seen":1431970653869,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.148","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00530{"flow_id":81,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":727,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970653,"pkt_ts_usec":973551,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB3yV5AAEAGj3DAqAEinTeCsMgpAbtXW5OVu\/PiI4AYECwiRAAAAQEICj4x0dZOqL8U9IDgvpwdzGcEkd9CX4txidHNl7imFBAwZtm7PgDORMBSjaYWMXjPRWAjyRyC8GW2MJh6wHE92aXcM+JRSsWm\/1CudQ=="} 00521{"flow_id":74,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":728,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":499807,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"0NQSxnP1PBXCt3IOCABFAABxva5AAEAGmqnAqAEiQTffLcgnAbvOrma7ApkXD4AYECxrhAAAAQEICj4x0+NNlOpApvNYMEQS5cpK5u6346cd8BL2N20dvzqenZJMFcn1yRtBVTFQ\/i2ToNXpC7XoSTbRK6UPDCtXBWtUo6jCxA=="} 00514{"flow_id":73,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":729,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":678977,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"0NQSxnP1PBXCt3IOCABFAABs0lFAAEAGHaXAqAEinTfrk8gmAbvxz5zEZu7sLYAYECw6uwAAAQEICj4x1JZMYEfZsJPOrYWxbQ2kS5GoHYZTSJUEAhUVjQ9Suc6gMln7jVEiXtQHYU+2Wg9JNG\/SECNBnGag8RNJ4KY="} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":730,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":92,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":730,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":821677,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6wW8AAEARn+fAqAEiQAQXjjLdnFcAJg\/KexMCQ3jYuEugpNmWmUQtEzO7LdTOeKZd1ItpRQQC"} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":730,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":730,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":92,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.142","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00496{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":731,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":93,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":731,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":821678,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA03zwAAEARghzAqAEiQAQXkjLdgQkAIIDZexUCZ4W5ZqoZlNOePqUvRCFg3WRtDoC9"} -00536{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":731,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":731,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":93,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":732,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.149","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":94,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":732,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":821742,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/GZwAAEARf3vAqAEinTeClTLdnEsAK1wIexcCaeXnH1khWR2dVjoEFgFOwJFG48UKy+DykqMrgwb0UzA="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":732,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.149","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":732,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":94,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.149","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":733,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":95,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":733,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":821742,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBOycAAEARwEbAqAEib91NlzLdnF0ALQ\/xexkCYPXpRAQdHH0\/jNHVbGCv27qhgsGUdDsPAuuhBF8LGQtOxA=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":733,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":733,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":95,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":734,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":96,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":734,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970654,"pkt_ts_usec":821742,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAm5UAAEARk+DAqAEi1cezpTLdnEQALDM7exsCCwiB5Tp\/+eOgtAg8Bibngtvk3Z9waqj3cY7b3c6tDEmT"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":734,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":734,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":96,"flow_packet_id":1,"flow_first_seen":1431970654821,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00548{"flow_id":22,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":735,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":127494,"pkt_caplen":145,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":145,"pkt_l4_len":111,"pkt":"PBXCt3IO0NQSxnP1CABFAACDdRxAADMGPzqdODQcwKgBIgG7yCDj6Zk1JLpYdYAYAB1wuQAAAQEICkxf\/gA+MY4\/FgMBAEoCAABGAwFAG+SGAq3gKeF3dOVEucmctDExXgLdd50VSpYJul2ocCAcoOT2TGNRri+OTuHmdmoKiNXYxVyumMXkgfIqab+QWAAFAA=="} 00419{"flow_id":22,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":736,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":127563,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAoU2tAAEAGVEbAqAEinTg0HMggAbskulh1AAAAAFAEAADVtgAA"} 00517{"flow_id":75,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":737,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":323128,"pkt_caplen":124,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":124,"pkt_l4_len":90,"pkt":"0NQSxnP1PBXCt3IOCABFAABuJZBAAEAGmSXAqAEib91KLcgoAbtIes\/7DU2rDIAYECxznwAAAQEICj4x1xlNh64VXoBGQFpplMys2JWIO4+I29OA4cPWkJJGByBiX+YJVXNQ2TREXlwyKhu2PLot6b6UkyYNEZ8cQhCRbQ=="} @@ -565,19 +565,19 @@ 00452{"flow_id":97,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":740,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":836661,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABANxVAAEAGcHTAqAEinTg0LMgunFRemxUUAAAAALAC\/\/+0UAAAAgQFtAEDAwUBAQgKPjHZGQAAAAAEAgAA"} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":741,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00434{"flow_id":98,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":741,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":836975,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyDf8AAEARix7AqAEinTeCnDLdnFMAHh0Aex0Cxk3n0hRKPcgDeocb540rNGApyA=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":741,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":741,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":98,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.156","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":742,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.27","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00458{"flow_id":99,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":742,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":836975,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBoCUAAEAR+GnAqAEiQTffGzLdnF0ALfl1ex8CqPqPm6RB3JLpE4+TALz\/NA1U\/CYbcdFd\/zzgY3E\/zKJhBw=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":742,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.27","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":742,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":99,"flow_packet_id":1,"flow_first_seen":1431970655836,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.27","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":743,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":100,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":743,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":837009,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6UqAAAEARkIPAqAEinTc4jjLdnE0AJphseyECmYsgkMQHN\/YIHMBu8w6RdZxUPKbDb+JHSqeN"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":743,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":743,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":100,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.142","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":744,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.154","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":101,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":744,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":837009,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4DEcAAEARVQbAqAEiQAQXmjLdnGAAJHYfeyMC79DK\/hLwI0tI0UYsgGEWGk5hr4E5iC40QQ=="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":744,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.154","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":744,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":101,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.154","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":745,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":102,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":745,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970655,"pkt_ts_usec":837137,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5ayYAAEARfGrAqAEinTg0ITLdnEIAJe9eeyUCb3+11x21V+othQ6FZpV0z1bnAthdPIEc8bI="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":745,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":745,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":97,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":746,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":151384,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADMGtI2dODQswKgBIpxUyC6j+8V4XpsVFaASOJDYRQAAAgQFrAQCCApMZ\/6WPjHZGQEDAwk="} 00436{"flow_id":97,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":747,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":151461,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0HiFAAEAGiXTAqAEinTg0LMgunFRemxUVo\/vFeYAQECwuNgAAAQEICj4x2lNMZ\/6W"} 00561{"flow_id":97,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":748,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":152015,"pkt_caplen":156,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":156,"pkt_l4_len":122,"pkt":"0NQSxnP1PBXCt3IOCABFAACOOrdAAEAGbITAqAEinTg0LMgunFRemxUVo\/vFeYAYECxXoQAAAQEICj4x2lNMZ\/6Wrhs79BGYhMMB7iEF5tcHMoy4VALgEGzyG5tHOfMPK\/eAX\/weDS1SZ6oiHiBYEb64N3y9yjNIGXbv1DXiayARDqcsrfqj+AmmX4QlEtvQAT4X3J0qE6j51s80"} @@ -588,19 +588,19 @@ 00448{"flow_id":67,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":753,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":509026,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8OGhAAEAGIKLAqAEinTeCsMglnFZwrI9kwvNOL4AYECm\/BAAAAQEICj4x27ZOqL2E+DHKQRbsUKg="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":754,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":103,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":754,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":861167,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1wZMAAEARPVPAqAEib91KKjLdnEYAIaXieycCe1fKnMoPyS7sKN+ClU5dh7E8u7Wn6g=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":754,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":754,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":103,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.42","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":755,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40020,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":104,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":755,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":861168,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3VcEAAEAR2kbAqAEinTfrrDLdnFQAI1TmeykCBTNtXbhMDQf2D6UV0R3mHu30wTeW\/+eg"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":755,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":755,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":104,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.172","src_port":13021,"dst_port":40020,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":756,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.167","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":105,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":756,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":861258,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAylicAAEARmerAqAEinTfrpzLdnF0AHsxpeysCNBmO6n4oPt4qGVJFTPBgQCMCbA=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":756,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.167","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":756,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":105,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.167","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":757,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":106,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":757,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":861258,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+1C4AAEARDvPAqAEinTc4jDLdnEMAKhWUey0Ck6OV07meiCUQoBZZK2TePWK3VEloqo0Om\/LmRrc7qA=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":757,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":757,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":106,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":758,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.156","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":107,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":758,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":861258,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBaS8AAEARxk7AqAEi1ceznDLdnF8ALXpUey8C35QflkiVLuyYHEgftQvOcxrFG1PZDcVv\/V5f70upN2kVjw=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":758,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.156","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":758,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":107,"flow_packet_id":1,"flow_first_seen":1431970656861,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.156","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":61,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":759,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970656,"pkt_ts_usec":877174,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA86MxAAEAG1hrAqAEib91KLcgknEjYMAoJdih2JIAYEClPvgAAAQEICj4x3SZNh6yILYCuK5us2zw="} 00447{"flow_id":59,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":760,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":144362,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8f5BAAEAGcJbAqAEinTfrk8ginEEPp73th03onYAYECkjxAAAAQEICj4x3jBMYEZOu98xvI+OKgs="} 00691{"flow_id":18,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":761,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":192569,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtCkVAAEAGNIjAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECzZgAAAAQEICj4x3l\/sPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} @@ -615,19 +615,19 @@ 00453{"flow_id":109,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":768,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867433,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAUUpAAEAGahfAqAEib91Nr8gwnF4IVezmAAAAALAC\/\/8+qQAAAgQFtAEDAwUBAQgKPjHhAAAAAAAEAgAA"} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":769,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.13","src_port":13021,"dst_port":40021,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":110,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":769,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867668,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9oHUAAEARRyvAqAEinTg0DTLdnFUAKQgoezEC\/l8nlzJZpnLIFE7P8fkc8mrPmKIpl9hxLirEQuOc"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":769,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.13","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":769,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":110,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.13","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":770,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":111,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":770,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867668,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4f1AAAEARf6LAqAEib91KGzLdnFsAJDT4ezMCrsyhXN3LQtIkyb75hiLtvYPm8jFPNUJJrw=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":770,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":770,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":111,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.27","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":771,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":112,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":771,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867722,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+qWkAAEARhrHAqAEinTfrkjLdgQkAKiNZezUC\/2slHaKqOmhTH+zKnxlHa\/OJZyFRbGPJo\/ii7tiMOQ=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":771,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":771,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":112,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":772,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40008,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":113,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":772,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867722,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA13XsAAEARu5rAqAEinTeCoDLdnEgAIdXCezcCHsxzqj9mHv\/LaKdjYymm7xXHyFOeHw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":772,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":772,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":113,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.160","src_port":13021,"dst_port":40008,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":773,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.42","src_port":13021,"dst_port":40005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":114,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":773,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970657,"pkt_ts_usec":867722,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9HFoAAEARyynAqAEinTg0KjLdnEUAKXprezkCzIUWKH677Ew8QeRY2LFi0olqYWN\/wfRNYM+xO4zo"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":773,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.42","src_port":13021,"dst_port":40005,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":773,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.42","src_port":13021,"dst_port":40005,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":108,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":774,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":15615,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0\/zFAADMGtWOdODQswKgBIgG7yC\/usf9MunqupIAQAB1WngAAAQEICkxoAH0+MeCz"} 00532{"flow_id":108,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":775,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":15668,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"0NQSxnP1PBXCt3IOCABFAAB57e9AAEAGuWDAqAEinTg0LMgvAbu6eq6k7rH\/TIAYECyFzQAAAQEICj4x4ZRMaAB9rs4rj\/Zn4y1sqwdIy3afkOEmLBspD4c0rMSeRLd9b91SLsTSeHa0jfo08XXIbE1KDwebW7o1FbLX0Wq5X\/ZmIfUdu0eE"} 00531{"flow_id":81,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":776,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":106871,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB324VAAEAGfUnAqAEinTeCsMgpAbtXW5OVu\/PiI4AYECwSKwAAAQEICj4x4e9OqL8U9IDgvpwdzGcEkd9CX4txidHNl7imFBAwZtm7PgDORMBSjaYWMXjPRWAjyRyC8GW2MJh6wHE92aXcM+JRSsWm\/1CudQ=="} @@ -642,38 +642,38 @@ 00449{"flow_id":109,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":785,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":477870,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8w3xAAEAG9+jAqAEib91Nr8gwnF4IVe1D0FEsUoAYECncyQAAAQEICj4x419No+Jb\/KZqQh\/x2yw="} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":786,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00435{"flow_id":115,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":786,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":879063,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0MmQAAEARtULAqAEinTg0EDLdnGAAINARezsCntsIeaNpS6NjCmJc+OoOrMkvCcDa"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":786,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":786,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":115,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":787,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":116,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":787,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":879242,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAykUAAEARZUbAqAEi1cezjzLdnFIALAJQez0CXU0wVq4fYZh\/Y+8+QJuiiaVycN5JEmy9Mj2R1c64L1Y6"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":787,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":787,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":116,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":788,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":117,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":788,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":879243,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7lJ0AAEARm2LAqAEinTfrsDLdnF8AJ1FIez8C0TqVtIrtp1zqD0lx1wHOKMmPMNUvlfjRgE8UFg=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":788,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":117,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.176","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":789,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":118,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":789,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":879243,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4HuEAAEARyLnAqAEinTg0GDLdnGAAJDiFe0ECGzhHlfYpbTJCQlYvElI0z7NbdWF7vdKvag=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":789,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":789,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":118,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":790,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":119,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":790,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970658,"pkt_ts_usec":879243,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/Lr4AAEAR0DTAqAEib91KFDLdnGEAK3JGe0MC70klwlgauZl1jUNJ9T6muSj9wXln3SVqW5QyJa+s4xA="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":790,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":790,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":119,"flow_packet_id":1,"flow_first_seen":1431970658879,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":791,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":1,"flow_first_seen":1431970659480,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":120,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":791,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":480110,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAaDxAAEAGUyXAqAEib91Nr8gyAbuh2H3fAAAAALAC\/\/+ohwAAAgQFtAEDAwUBAQgKPjHnRwAAAAAEAgAA"} 00493{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":792,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":121,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.166","src_port":51251,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":121,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":792,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":834732,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAPbBAAEAG45PAqAEiQAQXpsgznF2bjnkgAAAAALAC\/\/99bQAAAgQFtAEDAwUBAQgKPjHoqQAAAAAEAgAA"} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":793,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":122,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":793,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":834986,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1elAAAEARHtbAqAEinTeCkDLdnFAAIfN1e0UCt0zo\/WrZ+Zw8Ki6+SR8vgG1TLjatCw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":793,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":793,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":122,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.144","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":794,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":123,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":794,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":834986,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/fyEAAEARaHbAqAEinTg0FDLdnGEAK5aLe0cCmWiuCofYyBz6GXTZdvI4LweQLKgxsl8j0KcXdBMS+c8="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":794,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":794,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":123,"flow_packet_id":1,"flow_first_seen":1431970659834,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.20","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":795,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.144","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":124,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":795,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":835052,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBTDEAAEAR4+jAqAEinTfrkDLdnGAALTL8e0kC17QicxuXB5auWkNIni8RcFzpWBK6wb+NIPIUjtvt0ICuYw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":795,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.144","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":795,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":124,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.144","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":796,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":125,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":796,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":835052,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+n20AAEARW\/XAqAEib91NpTLdnEQAKqfKe0sCA3KviLJG1lAzDVoG9idWXcbF4pfswWYweShFk+5UVw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":796,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":796,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":125,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.165","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":797,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":126,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":797,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":835052,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA71A4AAEARxQ\/AqAEinTeCkjLdnGEAJ5FDe00CRUi6WS8h8mPi8e9oMy1XIZqCitDbn3NkpyCi9w=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":797,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":797,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":126,"flow_packet_id":1,"flow_first_seen":1431970659835,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":120,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":798,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":837706,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADYGxWVv3U2vwKgBIgG7yDJl2k5Wodh94KASOJCbeAAAAgQFrAQCCApNo+OiPjHnRwEDAwk="} 00437{"flow_id":120,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":799,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":837783,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0vZ1AAEAG\/c\/AqAEib91Nr8gyAbuh2H3gZdpOV4AQECzxPQAAAQEICj4x6KxNo+Oi"} 00534{"flow_id":120,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":800,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970659,"pkt_ts_usec":837881,"pkt_caplen":138,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":138,"pkt_l4_len":104,"pkt":"0NQSxnP1PBXCt3IOCABFAAB8I7FAAEAGl3TAqAEib91Nr8gyAbuh2H3gZdpOV4AYECyksgAAAQEICj4x6KxNo+OigEYBAwEALQAAABAAAAUAAAQAAAoAAAkAAGQAAGIAAAgAAAMAAAYBAIAHAMADAIAGAEACAIAEAIAFcrsw4Z73PH2K8wjZNq+U"} @@ -698,10 +698,10 @@ 00449{"flow_id":2,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":818,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970660,"pkt_ts_usec":781889,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABADV8AAEAR6drAqAEiwKgBAdb0ADUALMTUeDABAAABAAAAAAAAAWEGY29uZmlnBXNreXBlA2NvbQAAAQAB"} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":819,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":128,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":819,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970660,"pkt_ts_usec":848421,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6TMEAAEARsjLAqAEib91KGDLdnGAAJk69e08C7Jn\/msaru979SjBYNnh0LMk7Ko\/+l6KrptIV"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":819,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":819,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":128,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.24","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":820,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":129,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":820,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970660,"pkt_ts_usec":848422,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4j48AAEARa97AqAEib91NoDLdnFAAJOlwe1ECSObCw6nUMfh7bnqIU3mueprtSIlR2AyZTQ=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":820,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":820,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":129,"flow_packet_id":1,"flow_first_seen":1431970660848,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.160","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00455{"flow_id":4,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":821,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970660,"pkt_ts_usec":882697,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDA9cAAEAR81\/AqAEiwKgBAe0QADUAL\/kqxMsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAAQAB"} 00454{"flow_id":5,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":822,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970660,"pkt_ts_usec":882768,"pkt_caplen":81,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":81,"pkt_l4_len":47,"pkt":"0NQSxnP1PBXCt3IOCABFAABDBJcAAEAR8p\/AqAEiwKgBAeUHADUAL+4jvNsBAAABAAAAAAAABGNvbm4Fc2t5cGUGYWthZG5zA25ldAAAHAAB"} 00444{"flow_id":6,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":823,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":89012,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7i9kAAEARa2XAqAEiwKgBAfrwADUAJ8Zq760BAAABAAAAAAAAA2FwaQVza3lwZQNjb20AAAEAAQ=="} @@ -725,13 +725,13 @@ 00522{"flow_id":130,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":853,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":848719,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"0NQSxnP1PBXCt3IOCABFAABxQiNAAEAG3u\/AqAEiQAQXpsg1Abs0yMstLkeiTIAYECzU8AAAAQEICj4x8HtMQvMvj3RAvemHT+P7z0rouwAwTgf6jSGe3VlkB506Kg5x6iMueUoaC06tZlkow8O3V51nHVDge5Zkoq+VQDfaxQ=="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":854,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":131,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":854,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":855921,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAgx0AAEARe8zAqAEib91KHDLdnFoALOnqe1MCA8GYjWWu9fDS5z8O1HnUzLtilbW9STWNzZ4dxAZIYogR"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":854,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":854,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":131,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.28","src_port":13021,"dst_port":40026,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":855,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":132,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":855,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":855921,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3uKMAAEAR4H7AqAEinTeCkjLdgQkAI\/pPe1UCb1OUWk4YvTHMO4jKAgG4ML6WHkkTPHmm"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":855,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":855,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":132,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":856,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.152","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":133,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":856,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":855985,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6xIYAAEAR1JLAqAEinTeCmDLdnFYAJvNGe1cC+NCgg6iFX83BbHq4v+mwzzHLJiFQXcBRQbw9"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":856,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.152","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":856,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":133,"flow_packet_id":1,"flow_first_seen":1431970661855,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.152","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00450{"flow_id":109,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":857,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970661,"pkt_ts_usec":909149,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA89dNAAEAGxZHAqAEib91Nr8gwnF4IVe1D0FEsUoAYECnPcQAAAQEICj4x8LdNo+Jb\/KZqQh\/x2yw="} 00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":858,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":102,"flow_packet_id":1,"flow_first_seen":1431970655837,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.33","src_port":13021,"dst_port":40002,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":858,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":114,"flow_packet_id":1,"flow_first_seen":1431970657867,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.42","src_port":13021,"dst_port":40005,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -786,10 +786,10 @@ 00466{"flow_id":21,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":863,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970662,"pkt_ts_usec":705101,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABL2k0AAEARHOHAqAEiwKgBAcopADUAN1kA5GsBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":864,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.172","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":134,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":864,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970662,"pkt_ts_usec":914582,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+nlYAAEARkRrAqAEi1cezrDLdnEsAKjxNe1kCd7pyWFY\/2XtrOx7QzlcFNoQgfV3dFZmCGAMb34HK5w=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":864,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.172","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":864,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":134,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.172","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":865,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":135,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":865,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970662,"pkt_ts_usec":914582,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3jiIAAEAR0y7AqAEiQAQXlzLdnF0AI+cqe1sCynRK6RblWzdW13\/d3OH7SI3y+M61XQ85"} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":865,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":865,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00448{"flow_id":61,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":866,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970662,"pkt_ts_usec":966772,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8xIdAAEAG+l\/AqAEib91KLcgknEjYMAoJdih2JIAYECk4DQAAAQEICj4x9NdNh6yILYCuK5us2zw="} 00520{"flow_id":130,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":867,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":47901,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"0NQSxnP1PBXCt3IOCABFAABxXIpAAEAGxIjAqAEiQAQXpsg1Abs0yMstLkeiTIAYECzQQwAAAQEICj4x9ShMQvMvj3RAvemHT+P7z0rouwAwTgf6jSGe3VlkB506Kg5x6iMueUoaC06tZlkow8O3V51nHVDge5Zkoq+VQDfaxQ=="} 00531{"flow_id":81,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":868,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":290033,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB3DI9AAEAGTEDAqAEinTeCsMgpAbtXW5OVu\/PiI4AYECz+AQAAAQEICj4x9hhOqL8U9IDgvpwdzGcEkd9CX4txidHNl7imFBAwZtm7PgDORMBSjaYWMXjPRWAjyRyC8GW2MJh6wHE92aXcM+JRSsWm\/1CudQ=="} @@ -797,13 +797,13 @@ 00691{"flow_id":18,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":870,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":754371,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtK5ZAAEAGEzfAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECy\/9wAAAQEICj4x9+jsPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":871,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.176","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":136,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":871,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":923214,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3FyoAAEARSg7AqAEiQAQXsDLdnEEAI4rRe10CzbovR94s4Zxf8rLQnBsqBqSn7dHSA+Hg"} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":871,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.176","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":871,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.176","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":872,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":137,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":872,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":923214,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6rCQAAEAR7PjAqAEinTeClDLdnFMAJgbKe18CYcW5TKiM44ghnCPOJzkfQkjh9HCzfXzFFif7"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":872,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":872,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":137,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.148","src_port":13021,"dst_port":40019,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":873,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00447{"flow_id":138,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":873,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970663,"pkt_ts_usec":923286,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8YPIAAEARzyHAqAEinTfrmzLdnFsAKKqoe2ECDwqATU5QUcdDsP2+OoC0sJan4F5erjlhYCY+cbA="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":873,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":873,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":138,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.155","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":10,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":140615,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8b7ZAAEAGN+fAqAEinTg0HMgdnEkK2QS07hN6BYAZECmVhAAAAQEICj4x+WpMX+qKABUsdMFxBVE="} 00521{"flow_id":130,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":247785,"pkt_caplen":127,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":127,"pkt_l4_len":93,"pkt":"0NQSxnP1PBXCt3IOCABFAABx5GdAAEAGPKvAqAEiQAQXpsg1Abs0yMstLkeiTIAYECzLlgAAAQEICj4x+dVMQvMvj3RAvemHT+P7z0rouwAwTgf6jSGe3VlkB506Kg5x6iMueUoaC06tZlkow8O3V51nHVDge5Zkoq+VQDfaxQ=="} 00516{"flow_id":120,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":877,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":347166,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"0NQSxnP1PBXCt3IOCABFAABsIKZAAEAGmo\/AqAEib91Nr8gyAbuh2H4oZdpOV4AYECx\/MwAAAQEICj4x+jdNo+P8rykSL\/YNWXmmSdsJysigGnvSxhmV7qYqIM+fUQQnb8UpRj+FOZcGRraAYWqHRq8j3tnIqulYKJg="} @@ -816,10 +816,10 @@ 00488{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":880,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1431970664698,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.229","dst_ip":"224.0.0.251","l4_proto":2,"ndpi": {"proto":"IGMP","breed":"Acceptable","category":"Network"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":881,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":141,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":881,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":878431,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/kL8AAEARaq3AqAEib91NmjLdnFEAK0H5e2MCFDnpGlF82iGY4eNpUibWNoDaPXvzzVnf0YiL6zK2YSk="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":881,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":881,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":141,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.154","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":882,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":142,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":882,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":878432,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5Q+cAAEARHWrAqAEiQAQXlTLdnF4AJXN2e2UCDFA+Qxh89YvJZEs857N5H5uVs05hCuMkyAI="} -00537{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00543{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":142,"flow_packet_id":1,"flow_first_seen":1431970664878,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00450{"flow_id":121,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":883,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970664,"pkt_ts_usec":926552,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8QLhAAEAG4I\/AqAEiQAQXpsgznF2bjnl5scFgjYAYECndrAAAAQEICj4x\/HpMQvGckklqarCuvYw="} 00451{"flow_id":109,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":884,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":132695,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8djhAAEAGRS3AqAEib91Nr8gwnF4IVe1D0FEsUoAYECnC4AAAAQEICj4x\/UhNo+Jb\/KZqQh\/x2yw="} 00435{"flow_id":59,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":885,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":892802,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0abpAAEAGhnTAqAEinTfrk8ginEEPp731h03onYARECmo8AAAAQEICj4yAEBMYEZO"} @@ -832,13 +832,13 @@ 00436{"flow_id":81,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":892,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":893059,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0H05AAEAGOcTAqAEinTeCsMgpAbtXW5PYu\/PiI4ARECzlfgAAAQEICj4yAEBOqL8U"} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":893,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.171","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":143,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":893,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":893059,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyYRMAAEARmlXAqAEib91NqzLdnF4AHu9ce2cCLa6FGK\/rw+WZJkTZL2SD2CNvhA=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":893,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.171","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":893,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":143,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.171","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":894,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00439{"flow_id":144,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":894,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":893090,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1sE4AAEARMsfAqAEinTc4oTLdnF8AITASe2kC9psOqbEN3IbEA34wiMcNZp24IiAl1w=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":894,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":894,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":144,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.161","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":895,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.148","src_port":13021,"dst_port":40033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00450{"flow_id":145,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":895,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970665,"pkt_ts_usec":893094,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9lmMAAEARmbbAqAEinTfrlDLdnGEAKXtSe2sCw7Vy\/6hHK2XTagfLmixWAHOAd\/loE1p\/EyV7QPa1"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":895,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.148","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":895,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":145,"flow_packet_id":1,"flow_first_seen":1431970665893,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.148","src_port":13021,"dst_port":40033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00533{"flow_id":108,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":896,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":274816,"pkt_caplen":135,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":135,"pkt_l4_len":101,"pkt":"0NQSxnP1PBXCt3IOCABFAAB58G5AAEAGtuHAqAEinTg0LMgvAbu6eq6k7rH\/TIAYECxlpAAAAQEICj4yAb1MaAB9rs4rj\/Zn4y1sqwdIy3afkOEmLBspD4c0rMSeRLd9b91SLsTSeHa0jfo08XXIbE1KDwebW7o1FbLX0Wq5X\/ZmIfUdu0eE"} 00445{"packet_event_id":1,"packet_event_name":"packet","thread_id":0,"packet_id":897,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":370007,"pkt_caplen":100,"pkt_type":94,"pkt_l3_offset":14,"pkt_l4_offset":0,"pkt_len":100,"pkt_l4_len":0,"pkt":"AQAMzMzMJKQ8\/kzXAF6qqgMAAAwgAAF4S2kAAQAOQWlyR2F0ZXdheQACABEAAAABAQHMAATAqAHbAAQACAAAAAIABQAQQWlyR1cudjEuMC4zAAYAB0FHVwADAAdicjAA\/wAFLg=="} 00156{"basic_event_id":5,"basic_event_name":"Unknown packet type","thread_id":0,"packet_id":897,"source":"skype_no_unknown.pcap","alias":"nDPId-test","type":94} @@ -853,10 +853,10 @@ 00453{"flow_id":149,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":902,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":903155,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAfbxAAEAGcbnAqAEi1cezsMg6nFWOWkeEAAAAALAC\/\/9u6QAAAgQFtAEDAwUBAQgKPjIEMAAAAAAEAgAA"} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":903,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":150,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":903,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":903260,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9fE8AAEARfyTAqAEib91NlTLdnFAAKVN0e20CYiNLpCtZKVRm5qzsJsm2qgqqm\/VHJHAXu9AEnz3Z"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":903,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":903,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":150,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.149","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":904,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":151,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":904,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":903278,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7vtoAAEARQB3AqAEib91KEzLdnEEAJxFYe28CrL8oxTm2+6Ol0c4xcn\/aCmr6scDIaqNamEoS7g=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":904,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":904,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":151,"flow_packet_id":1,"flow_first_seen":1431970666903,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.19","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":149,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":905,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":958576,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADgG93nVx7OwwKgBIpxVyDpdiXkDjlpHhaASOJCjtgAAAgQFrAQCCApO3n4vPjIEMAEDAwk="} 00435{"flow_id":149,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":906,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":958681,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0TkBAAEAGoUHAqAEi1cezsMg6nFWOWkeFXYl5BIAQECz6qQAAAQEICj4yBGdO3n4v"} 00569{"flow_id":149,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":907,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970666,"pkt_ts_usec":959233,"pkt_caplen":162,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":162,"pkt_l4_len":128,"pkt":"0NQSxnP1PBXCt3IOCABFAACU3h1AAEAGEQTAqAEi1cezsMg6nFWOWkeFXYl5BIAYECzwwAAAAQEICj4yBGdO3n4vpH+4YbRf46LMGng\/E51p5GZzYC9xP5Es2\/w2eKnW9UtZ6FFtAFdhjFPvc+i78cRadFWCi8AxrsfMzZrDmClGfyRFsvtwId43fL3KM0gZdu\/UNeJrIBEOpyyt+qP4CaZf"} @@ -891,20 +891,20 @@ 00448{"flow_id":149,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":936,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970667,"pkt_ts_usec":843268,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8D8hAAEAG37HAqAEi1cezsMg6nFWOWkflXYl5QIAYECpJUAAAAQEICj4yB9RO3n48uQiwNY7rtQs="} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":937,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00443{"flow_id":152,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":937,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970667,"pkt_ts_usec":913849,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6bg8AAEARKxbAqAEinTeCjDLdnEsAJgsKe3ECMurpMuGdyMUwflNlvhyptKR18dfr99Rpa+D7"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":937,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":937,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":152,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.140","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":938,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":153,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970667,"pkt_ts_usec":913849,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBDu8AAEARihTAqAEinTeCpzLdnF8ALeNce3MCnSaJe8js0\/W0uOkrjvFqVEozNuFXZVFpbX\/qiFWAThpduA=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":938,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":938,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":153,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.167","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":939,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":154,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970667,"pkt_ts_usec":913913,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA4i7gAAEARb8PAqAEib91NkjLdgQkAJGEVe3UC\/j9SXtMCBQsEGLuepyVsXxpYMSM\/UQo5ag=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":939,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":939,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00449{"flow_id":148,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":940,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970667,"pkt_ts_usec":989480,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8+klAAEAG9cXAqAEinTfrqsg5nGDRQCMtGayygYAYECiBLgAAAQEICj4yCGZMVm\/1OYUqH2Q1qrY="} 00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":941,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63342,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":155,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":941,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":278677,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA6QgAAEARDjHAqAEiwKgBAfduADUALM6fTeoBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} -00662{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":941,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63342,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00668{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":941,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63342,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":942,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64258,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":156,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":942,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":278886,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAkhAAAEARZSnAqAEiwKgBAfsCADUALD+l2TUBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAHAAB"} -00663{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64258,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00669{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":942,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":1,"flow_first_seen":1431970668278,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64258,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"b.config.skype.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00792{"flow_id":49,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":943,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":328383,"pkt_caplen":327,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":327,"pkt_l4_len":293,"pkt":"AQBef\/\/6oPPBbTu2CABFAAE5BIwAAAQR\/4fAqAD+7\/\/\/+gQBB2wBJULdTk9USUZZICogSFRUUC8xLjENCkhPU1Q6IDIzOS4yNTUuMjU1LjI1MDoxOTAwDQpDQUNIRS1DT05UUk9MOiBtYXgtYWdlPTEwMA0KTE9DQVRJT046IGh0dHA6Ly8xOTIuMTY4LjAuMjU0OjE5MDAvaWdkLnhtbA0KTlQ6IHV1aWQ6dXBucC1XQU5EZXZpY2UtMTkyMTY4MDI1NDc4OTAwMDAxDQpOVFM6IHNzZHA6YWxpdmUNClNFUlZFUjogVFAtTElOSyBXaXJlbGVzcyBOIE5hbm8gUm91dGVyIFdSNzAyTiwgVVBuUC8xLjANClVTTjogdXVpZDp1cG5wLVdBTkRldmljZS0xOTIxNjgwMjU0Nzg5MDAwMDENCg0K"} 00848{"flow_id":49,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":944,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":344610,"pkt_caplen":369,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":369,"pkt_l4_len":335,"pkt":"AQBef\/\/6oPPBbTu2CABFAAFjBI0AAAQR\/1zAqAD+7\/\/\/+gQBB2wBT72wTk9USUZZICogSFRUUC8xLjENCkhPU1Q6IDIzOS4yNTUuMjU1LjI1MDoxOTAwDQpDQUNIRS1DT05UUk9MOiBtYXgtYWdlPTEwMA0KTE9DQVRJT046IGh0dHA6Ly8xOTIuMTY4LjAuMjU0OjE5MDAvaWdkLnhtbA0KTlQ6IHVybjpzY2hlbWFzLXVwbnAtb3JnOmRldmljZTpXQU5EZXZpY2U6MQ0KTlRTOiBzc2RwOmFsaXZlDQpTRVJWRVI6IFRQLUxJTksgV2lyZWxlc3MgTiBOYW5vIFJvdXRlciBXUjcwMk4sIFVQblAvMS4wDQpVU046IHV1aWQ6dXBucC1XQU5EZXZpY2UtMTkyMTY4MDI1NDc4OTAwMDAxOjp1cm46c2NoZW1hcy11cG5wLW9yZzpkZXZpY2U6V0FORGV2aWNlOjENCg0K"} 00514{"flow_id":120,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":945,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":359634,"pkt_caplen":122,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":122,"pkt_l4_len":88,"pkt":"0NQSxnP1PBXCt3IOCABFAABsw99AAEAG91XAqAEib91Nr8gyAbuh2H4oZdpOV4AYECxvkgAAAQEICj4yCdhNo+P8rykSL\/YNWXmmSdsJysigGnvSxhmV7qYqIM+fUQQnb8UpRj+FOZcGRraAYWqHRq8j3tnIqulYKJg="} @@ -945,13 +945,13 @@ 00450{"flow_id":148,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":977,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":904263,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8u2FAAEAGNK7AqAEinTfrqsg5nGDRQCMtGayygYAYECh9oQAAAQEICj4yC\/NMVm\/1OYUqH2Q1qrY="} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":978,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":161,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":978,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":973203,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1LlEAAEARAb\/AqAEinTfrpjLdnE8AIZ69e3cC3u8ghDSSA4Gtev71JCe8ggQmBcfTOg=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":978,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":978,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":161,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.166","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":979,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":162,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":979,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":973268,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyB6AAAEARJ\/jAqAEi1cezkTLdnFgAHgsae3kCyqgAJfxhjLbJRJUrPtsodh20jg=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":979,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":979,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":162,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.145","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":980,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":163,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":980,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":973268,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+wKIAAEAR1+DAqAEiQTffKjLdnFgAKi+se3sC0K9BEnPeD0WuBXXm5wareR+WL1\/qIQP+x9YGu9Sm5Q=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":980,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":980,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":163,"flow_packet_id":1,"flow_first_seen":1431970668973,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.42","src_port":13021,"dst_port":40024,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00517{"flow_id":160,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":981,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970668,"pkt_ts_usec":998419,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"0NQSxnP1PBXCt3IOCABFAABrGxBAAEAG1DrAqAEi1cezsMg+Absskrs7gA\/xNYAYECz9XAAAAQEICj4yDFFO3n\/RxnG4\/AJEgxSLpj4g1w1XejDcElFRdGJgTnfA7RCUIGPtheZryFD\/LSyJskZ7bbubC2TOpkOp3g=="} 00517{"flow_id":159,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":982,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":93710,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"pkt":"0NQSxnP1PBXCt3IOCABFAABwXWxAAEAGkm\/AqAEinTfrqsg9AbvoZ1rM+umGlIAYECxNmAAAAQEICj4yDLBMVnGKp9iYwrlcLUTfptpUQ9HnlFyq2KvXjkAGnxSlIXPZFxPNf26I7IG6HpdVzoKbtM+2y58XZOdHADBnVSgw"} 00434{"flow_id":157,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":983,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":96078,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA04rNAADcG4dpv3U2OwKgBIgG7yDsQofTK9u6LaYAQAB335AAAAQEICk2QFnk+MguP"} @@ -965,10 +965,10 @@ 00518{"flow_id":159,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":991,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":718745,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"pkt":"0NQSxnP1PBXCt3IOCABFAABw8NlAAEAG\/wHAqAEinTfrqsg9AbvoZ1rM+umGlIAYECxLKQAAAQEICj4yDx9MVnGKp9iYwrlcLUTfptpUQ9HnlFyq2KvXjkAGnxSlIXPZFxPNf26I7IG6HpdVzoKbtM+2y58XZOdHADBnVSgw"} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":992,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":164,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":992,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":927160,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2E64AAEARG+XAqAEi1cezkjLdnF4AIuLme30CQ7dH2z2v6k8Do\/cqwHkYPEueogZ7yfU="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":992,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":992,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":164,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":993,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00448{"flow_id":165,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":993,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":927161,"pkt_caplen":75,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":75,"pkt_l4_len":41,"pkt":"0NQSxnP1PBXCt3IOCABFAAA9jJkAAEARWu7AqAEinTg0JjLdnE8AKRAHe38C0EXr0Mxbt14LCxM+eOaK\/XZWtSRnQDNWL9r8hWuf"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":993,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":993,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00448{"flow_id":149,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":994,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":944918,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8QlNAAEAGrSbAqAEi1cezsMg6nFWOWkflXYl5QIAYECpBIwAAAQEICj4yEAFO3n48uQiwNY7rtQs="} 00448{"flow_id":146,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":995,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":960069,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8TPZAAEAGDDbAqAEinTeCjsg3nEXoG0gEyGJx5oAYECq7fwAAAQEICj4yEBBOwLXQr3KT27Tir4g="} 00450{"flow_id":97,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":996,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970669,"pkt_ts_usec":983230,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8JPJAAEAGgpvAqAEinTg0LMgunFRemxVvo\/vFuIAYECpuKwAAAQEICj4yECdMZ\/7lUZ\/2f58qofY="} @@ -978,10 +978,10 @@ 00421{"flow_id":74,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1000,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":192148,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAo\/8xAAEAGWNTAqAEiQTffLcgnAbvOrmb5AAAAAFAEAADOJgAA"} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1001,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61095,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00469{"flow_id":166,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1001,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":304110,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABL\/QYAAEAR+ifAqAEiwKgBAe6nADUAN3lCuqsBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAABAAE="} -00674{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1001,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61095,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00680{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1001,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61095,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1002,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55866,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00468{"flow_id":167,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1002,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":304363,"pkt_caplen":89,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":89,"pkt_l4_len":55,"pkt":"0NQSxnP1PBXCt3IOCABFAABLI7cAAEAR03fAqAEiwKgBAdo6ADUAN4ffpXsBAAABAAAAAAAABHBpcGUDcHJkCXNreXBlZGF0YQZha2FkbnMDbmV0AAAcAAE="} -00675{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1002,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55866,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00681{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1002,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":167,"flow_packet_id":1,"flow_first_seen":1431970670304,"flow_last_seen":0,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":47,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55866,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"pipe.prd.skypedata.akadns.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00691{"flow_id":18,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1003,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":315034,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADt4eBAAEAGXOzAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECymbwAAAQEICj4yEXDsPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00518{"flow_id":160,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1004,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":354192,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"0NQSxnP1PBXCt3IOCABFAABr48dAAEAGC4PAqAEi1cezsMg+Absskrs7gA\/xNYAYECz4FgAAAQEICj4yEZdO3n\/RxnG4\/AJEgxSLpj4g1w1XejDcElFRdGJgTnfA7RCUIGPtheZryFD\/LSyJskZ7bbubC2TOpkOp3g=="} 00533{"flow_id":81,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1005,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":460380,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB3LFBAAEAGLH\/AqAEinTeCsMgpAbtXW5OVu\/PiI4AZECziFwAAAQEICj4yEgFOqL8U9IDgvpwdzGcEkd9CX4txidHNl7imFBAwZtm7PgDORMBSjaYWMXjPRWAjyRyC8GW2MJh6wHE92aXcM+JRSsWm\/1CudQ=="} @@ -996,10 +996,10 @@ 00449{"flow_id":147,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1014,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":788978,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA81OtAAEAG5prAqAEib91Njsg4nE30S7wpxRcMPYAYECke7wAAAQEICj4yE0ZNkBTphTv5WfSZuu0="} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1015,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":168,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1015,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":941309,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyyNoAAEARNhPAqAEib91KJjLdnE8AHkdoe4ECIl4YB+sv8264lsMD2bF6lk0ImA=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1015,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1015,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":168,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1016,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.40","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":169,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1016,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":941372,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyjX8AAEARWhHAqAEinTg0KDLdnFEAHlwwe4MCZJjbDEMF5Jp3fN4mrZ11ZfLW0g=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1016,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.40","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1016,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.40","src_port":13021,"dst_port":40017,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00438{"flow_id":97,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1017,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":941522,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0I6dAAEAGg+7AqAEinTg0LMgunFRemxV3o\/vFuIARECrzuwAAAQEICj4yE95MZ\/7l"} 00438{"flow_id":108,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1018,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":941522,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0iuxAAEAGHKnAqAEinTg0LMgvAbu6eq7p7rH\/TIARECwTHgAAAQEICj4yE95MaAB9"} 00436{"flow_id":61,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1019,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970670,"pkt_ts_usec":955108,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA02WxAADYG74Jv3UotwKgBIpxIyCR2KHYs2DAKCYARAB23kgAAAQEICk2HwJ4+McPk"} @@ -1012,19 +1012,19 @@ 00456{"flow_id":170,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1026,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970671,"pkt_ts_usec":951288,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABArq9AAEAGEE\/AqAEib91KEshDnFkB\/oZbAAAAALAC\/\/94TQAAAgQFtAEDAwUBAQgKPjIXzQAAAAAEAgAA"} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1027,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.171","src_port":13021,"dst_port":40031,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00458{"flow_id":171,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1027,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970671,"pkt_ts_usec":951422,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBmb4AAEARx3TAqAEiQAQXqzLdnF8ALTBge4UCLJNHDZxrWqKO2le\/27Ln4ZxRCYpxEOdXlle+BhpaiN\/trw=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1027,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.171","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1027,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":171,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.171","src_port":13021,"dst_port":40031,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1028,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":172,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1028,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970671,"pkt_ts_usec":951423,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1BfQAAEAR+PHAqAEib91KKzLdnEEAIUqfe4cCc5jQ2kkfJiYMRWMm+FrbQ2W3s3qD9w=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1028,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1028,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":172,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.43","src_port":13021,"dst_port":40001,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1029,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":173,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1029,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970671,"pkt_ts_usec":951475,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0IIEAAEAReCLAqAEiQTffFDLdnFcAIOS9e4kCJNSTA+Y3HirwjN7M3H9IWhw2zkeB"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1029,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1029,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":173,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.20","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":165,"flow_packet_id":1,"flow_first_seen":1431970669927,"flow_last_seen":0,"flow_min_l4_payload_len":33,"flow_max_l4_payload_len":33,"flow_tot_l4_payload_len":33,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.38","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00500{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":169,"flow_packet_id":1,"flow_first_seen":1431970670941,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.40","src_port":13021,"dst_port":40017,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00458{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":140,"flow_packet_id":1,"flow_first_seen":1431970664698,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.229","dst_ip":"224.0.0.251","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} 00456{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":139,"flow_packet_id":1,"flow_first_seen":1431970664361,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.0.254","dst_ip":"224.0.0.1","l4_proto":2,"flow_datalink":1,"flow_max_packets":15} 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":154,"flow_packet_id":1,"flow_first_seen":1431970667913,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.146","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00525{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51267,"dst_port":40025,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00531{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51267,"dst_port":40025,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":170,"flow_packet_id":1,"flow_first_seen":1431970671951,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51267,"dst_port":40025,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":136,"flow_packet_id":1,"flow_first_seen":1431970663923,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.176","src_port":13021,"dst_port":40001,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00499{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1030,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":135,"flow_packet_id":1,"flow_first_seen":1431970662914,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.151","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -1069,10 +1069,10 @@ 00449{"flow_id":146,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1045,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970672,"pkt_ts_usec":669651,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8hKtAAEAG1IDAqAEinTeCjsg3nEXoG0gEyGJx5oAYECqw9wAAAQEICj4yGphOwLXQr3KT27Tir4g="} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1046,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":176,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1046,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970672,"pkt_ts_usec":959482,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1S7cAAEARFafAqAEiQAQXjDLdnEMAIfDFe4sC3LQi2HlVtL\/yF355PoVbgc9yifdOBA=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1046,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1046,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":176,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.140","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1047,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.158","src_port":13021,"dst_port":40021,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":177,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1047,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970672,"pkt_ts_usec":959483,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+TFEAAEARFPLAqAEiQAQXnjLdnFUAKkRXe40CBN0haY4HfyNbFaIJe0md26M72eisE+NIO7kZgnvi7w=="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1047,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.158","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1047,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":177,"flow_packet_id":1,"flow_first_seen":1431970672959,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.158","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00437{"flow_id":109,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1048,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970672,"pkt_ts_usec":959654,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0YTBAAEAGWj3AqAEib91Nr8gwnF4IVe1L0FEsUoARECkGfQAAAQEICj4yG7pNo+Jb"} 00437{"flow_id":120,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1049,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970672,"pkt_ts_usec":959654,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0aYhAAEAGUeXAqAEib91Nr8gyAbuh2H5gZdpOV4ARECy9VAAAAQEICj4yG7pNo+P8"} 00452{"flow_id":155,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1050,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970673,"pkt_ts_usec":547534,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAtKcAAEARQpLAqAEiwKgBAfduADUALM6fTeoBAAABAAAAAAAAAWIGY29uZmlnBXNreXBlA2NvbQAAAQAB"} @@ -1088,13 +1088,13 @@ 00454{"flow_id":179,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1058,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970673,"pkt_ts_usec":966269,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAY6tAAEAGi8vAqAEi1cezr8hFnF3LCMFlAAAAALAC\/\/+c0QAAAgQFtAEDAwUBAQgKPjIfpgAAAAAEAgAA"} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1059,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.171","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":180,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1059,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970673,"pkt_ts_usec":970845,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0vU0AAEARcr7AqAEinTfrqzLdnEYAIOCne48C+j3UCj6Khrhd65pIazZgrSV3BW0j"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1059,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.171","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1059,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":180,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.171","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1060,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":13021,"dst_port":40003,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":181,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1060,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970673,"pkt_ts_usec":970845,"pkt_caplen":72,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":72,"pkt_l4_len":38,"pkt":"0NQSxnP1PBXCt3IOCABFAAA6zOQAAEARzB\/AqAEinTeCrTLdnEMAJgAFe5ECW1GQc626NgViJqEYKjead5HrxbDyRckYY2Mu"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1060,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1060,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":181,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":30,"flow_max_l4_payload_len":30,"flow_tot_l4_payload_len":30,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.173","src_port":13021,"dst_port":40003,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1061,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":182,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1061,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970673,"pkt_ts_usec":970905,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA08VkAAEAR8c7AqAEinTc4jzLdnFIAIGspe5MC1RnFiDDpE1Hd7iM493fNRlWzMToF"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1061,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1061,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":182,"flow_packet_id":1,"flow_first_seen":1431970673970,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.143","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":179,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1062,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":18578,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADgG93rVx7OvwKgBIpxdyEUu77fnywjBZqASOJAmdQAAAgQFrAQCCApO3xkOPjIfpgEDAwk="} 00435{"flow_id":179,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1063,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":18641,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0ax5AAEAGhGTAqAEi1cezr8hFnF3LCMFmLu+36IAQECx9awAAAQEICj4yH9pO3xkO"} 00571{"flow_id":179,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1064,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":19041,"pkt_caplen":164,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":164,"pkt_l4_len":130,"pkt":"0NQSxnP1PBXCt3IOCABFAACWN0BAAEAGt+DAqAEi1cezr8hFnF3LCMFmLu+36IAYECxWSwAAAQEICj4yH9pO3xkOsFDI7qsei964fUMEnfCOjiSi3+qAd86vtj0EFy+5edQ39AzLjWycx6MsRrBZOBFqVxzdalPoORYPdFWCi8AxrsfMzZrDmClGfyRFsvtwId43fL3KM0gZdu\/UNeJrIBEOpyw="} @@ -1112,13 +1112,13 @@ 00449{"flow_id":175,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1078,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":880712,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8oBRAAEAGHu7AqAEib91KEshDnFkB\/oa5lZep1YAYEChCDQAAAQEICj4yIzNNdq00xUaEJw2DyPo="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1079,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":183,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1079,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":981289,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/ed8AAEARbbrAqAEinTg0EjLdgQkAK+56e5UCujNYWaHOaIv8Mbnq8Yy9ltzxTGOAleIkOtVygbgwGI4="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1079,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1079,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":183,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1080,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":184,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1080,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":981289,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/QPIAAEARV4\/AqAEiQTffKzLdnEYAK9tXe5cCDvOGtur9CosePaKDkKEzL5ekZUj+DrgiIjruAPBzlGM="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1080,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1080,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":184,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1081,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.150","src_port":13021,"dst_port":40014,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":185,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1081,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":981352,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2DYgAAEAR1ZfAqAEinTc4ljLdnE4AIk81e5kCIa6rFGHkjW7tTxYGLEfEQXIXcRjIprw="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1081,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.150","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1081,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":185,"flow_packet_id":1,"flow_first_seen":1431970674981,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.150","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00437{"flow_id":121,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1082,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":981467,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0oQpAAEAGgEXAqAEiQAQXpsgznF2bjnmBscFgjYARECkhhgAAAQEICj4yI5dMQvGc"} 00437{"flow_id":130,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1083,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970674,"pkt_ts_usec":981467,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0pAxAAEAGfUPAqAEiQAQXpsg1Abs0yMtqLkeiTIARECwRKQAAAQEICj4yI5dMQvMv"} 00486{"flow_id":157,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1084,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970675,"pkt_ts_usec":476227,"pkt_caplen":100,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":100,"pkt_l4_len":66,"pkt":"0NQSxnP1PBXCt3IOCABFAABW72hAAEAGzAPAqAEib91Njsg7Abv27otpEKH0yoAYECzqiQAAAQEICj4yJYRNkBZ5b6tnM5g+MIH9ugWQ4EK6dUZuKY7n+8BcqJBKLNao313kcQ=="} @@ -1137,10 +1137,10 @@ 00454{"flow_id":187,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1095,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970675,"pkt_ts_usec":992044,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAxtRAAEAGKUnAqAEinTfrmMhInF05JqawAAAAALAC\/\/9CLwAAAgQFtAEDAwUBAQgKPjInhAAAAAAEAgAA"} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1096,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.147","src_port":13021,"dst_port":40014,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":188,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1096,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970675,"pkt_ts_usec":992172,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABB4XAAAEARAafAqAEinTc4kzLdnE4ALQw6e5sCLpawwxGRzNJ9jeoeh5bY+9RpiszLnAcSdcNuRnMOI9PLQQ=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1096,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.147","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1096,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":188,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.147","src_port":13021,"dst_port":40014,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1097,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":189,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1097,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970675,"pkt_ts_usec":992172,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1ktIAAEARBdLAqAEiQTffEjLdnFkAIdOte50CPL9ZRieP6CLGvHSnuteGzwQxXE6Sug=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1097,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1097,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":189,"flow_packet_id":1,"flow_first_seen":1431970675992,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.18","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00467{"flow_id":178,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1098,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":8062,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMySdAAEAG9crAqAEib91KEshEAbuPHWXUImhLeYAYECwpDwAAAQEICj4yJ5NNdq638u7zvxiLk1N\/bk90UuwO7GFozw5RA+4e"} 00489{"flow_id":186,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1099,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":61587,"pkt_caplen":104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":104,"pkt_l4_len":70,"pkt":"0NQSxnP1PBXCt3IOCABFAABazv5AAEAGIF7AqAEi1cezr8hHAbtzmW+D0lUdQ4AYECzB3wAAAQEICj4yJ8hO3xqxJBunUkBMeJMsfT1eF4pqVDnte2DgNERt9BmDXlOuUVzA32khXIM="} 00448{"flow_id":187,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1100,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":61751,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADYG+iGdN+uYwKgBIpxdyEgRBN2QOSamsaASOJC3pAAAAgQFrAQCCApMXif\/PjInhAEDAwk="} @@ -1160,10 +1160,10 @@ 00691{"flow_id":18,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1130,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":881699,"pkt_caplen":251,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":251,"pkt_l4_len":217,"pkt":"0NQSxnP1PBXCt3IOCABFAADtZZFAAEAG2TvAqAEiF84hpsgfAbv4Tz2YGDU8XoAYECyM5gAAAQEICj4yKvnsPW3FFgMBALQBAACwAwNVWiNLhX\/\/ejAO4KpxNC8\/ZrCwmmE9wkU90zxCDkcIKAAASgD\/wCTAI8AKwAnACMAowCfAFMATwBLAJsAlwAXABMADwCrAKcAPwA7ADQBrAGcAOQAzABYAPQA8ADUALwAKwAfAEcACwAwABQAEAQAAPQAAABMAEQAADmFwcHMuc2t5cGUuY29tAAoACAAGABcAGAAZAAsAAgEAAA0ADAAKBQEEAQIBBAMCAzN0AAA="} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40022,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":190,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":959268,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2RjwAAEAR6djAqAEinTfroDLdnFYAIpfGe58CtglNf35c9xed\/TOYZPtdg4AQKYWmKBE="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":190,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.160","src_port":13021,"dst_port":40022,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1132,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00445{"flow_id":191,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1132,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970676,"pkt_ts_usec":959269,"pkt_caplen":71,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":71,"pkt_l4_len":37,"pkt":"0NQSxnP1PBXCt3IOCABFAAA5iSIAAEARWf7AqAEinTc4kjLdnF4AJWUse6ECi+HEJAzVpo3ery\/yzADPEQnmy2088qUgojE="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1132,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1132,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":191,"flow_packet_id":1,"flow_first_seen":1431970676959,"flow_last_seen":0,"flow_min_l4_payload_len":29,"flow_max_l4_payload_len":29,"flow_tot_l4_payload_len":29,"flow_avg_l4_payload_len":29,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.56.146","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00449{"flow_id":187,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1133,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":62836,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8eChAAEAGd\/nAqAEinTfrmMhInF05JqcNEQTd4oAYEClKIwAAAQEICj4yK65MXigTaJ2t5RvhjU8="} 00435{"flow_id":97,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1134,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":69222,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0O6RAADMGePGdODQswKgBIpxUyC6j+8XAXpsVb4ARAB0n7gAAAQEICkxoExk+MduF"} 00450{"flow_id":175,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1135,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":137627,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8uTZAAEAGBczAqAEib91KEshDnFkB\/oa5lZep1YAYECg5SAAAAQEICj4yK\/hNdq00xUaEJw2DyPo="} @@ -1182,13 +1182,13 @@ 00449{"flow_id":187,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1147,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":960696,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8u0ZAAEAGNNvAqAEinTfrmMhInF05JqcNEQTd4oAYEClGpgAAAQEICj4yLytMXigTaJ2t5RvhjU8="} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1148,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":13021,"dst_port":40018,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":193,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1148,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":974229,"pkt_caplen":76,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":76,"pkt_l4_len":42,"pkt":"0NQSxnP1PBXCt3IOCABFAAA+xqAAAEAR0mLAqAEinTeCqjLdnFIAKv3he6MC3h4IlBBBiQEMzD2u81WGXlCVYngNZSbA0YydRzOnaw=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1148,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1148,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":193,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":34,"flow_tot_l4_payload_len":34,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.170","src_port":13021,"dst_port":40018,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1149,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.159","src_port":13021,"dst_port":40016,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":194,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1149,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":974230,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyXBgAAEARPQLAqAEinTeCnzLdnFAAHlQNe6UCbRCk9Zm0qay7l4LGg8ZPRvGp2A=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1149,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.159","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1149,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":194,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.159","src_port":13021,"dst_port":40016,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1150,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.170","src_port":13021,"dst_port":40021,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00453{"flow_id":195,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1150,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970677,"pkt_ts_usec":974294,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABATykAAEARrDLAqAEib91NqjLdnFUALAKIe6cC06nLoifBCja4NtBTBPAIMkjY1r+eVyo0K906xL\/RnajP"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1150,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.170","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1150,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":195,"flow_packet_id":1,"flow_first_seen":1431970677974,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.170","src_port":13021,"dst_port":40021,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00511{"flow_id":192,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1151,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":100002,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"0NQSxnP1PBXCt3IOCABFAABpUC5AAEAGn8bAqAEinTfrmMhKAbuh9dMOzkYJiIAYECyexAAAAQEICj4yL7ZMXimi86hE3Mf+F71gUhXfICsOYAQVmYXa6zVmVAN\/UCwMTk1xoRWYRdaWkDsfzScQ6Y1RzsI3trk="} 00448{"flow_id":61,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1152,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":255384,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA82W1AADYG73lv3UotwKgBIpxIyCR2KHYk2DAKCYAYAB1GaQAAAQEICk2Hx8A+McPk18UgKt1JlMY="} 00519{"flow_id":160,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1154,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":367207,"pkt_caplen":121,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":121,"pkt_l4_len":87,"pkt":"0NQSxnP1PBXCt3IOCABFAABr679AAEAGA4vAqAEi1cezsMg+Absskrs7gA\/xNYAYECzY7QAAAQEICj4yMMBO3n\/RxnG4\/AJEgxSLpj4g1w1XejDcElFRdGJgTnfA7RCUIGPtheZryFD\/LSyJskZ7bbubC2TOpkOp3g=="} @@ -1207,13 +1207,13 @@ 00437{"flow_id":109,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1163,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":984866,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0zltAADYG9xFv3U2vwKgBIpxeyDDQUSxaCFXtQ4ARAB062gAAAQEICk2j9mU+MeNf"} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1164,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40029,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":198,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1164,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":985147,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/p1UAAEAR8T7AqAEiQTffGDLdnF0AK+jLe6kC6fGNK2goAXsNse6RdApll6kRm4bOwgAP2hC\/D2eOAyk="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1164,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1164,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":198,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.24","src_port":13021,"dst_port":40029,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1165,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40027,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":199,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1165,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":985147,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7GMMAAEARF0\/AqAEinTfrnjLdnFsAJ5Hde6sCJ8R84KyvegILw5PDMDyyzP0qbIKzwXJl3e6CLA=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1165,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1165,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":199,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.158","src_port":13021,"dst_port":40027,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1166,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00444{"flow_id":200,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1166,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970678,"pkt_ts_usec":985207,"pkt_caplen":70,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":70,"pkt_l4_len":36,"pkt":"0NQSxnP1PBXCt3IOCABFAAA49SsAAEARo3fAqAEiQTffEDLdnGAAJBSJe60CT4+h0ZiCfQwqP7NMcZ5acjfF0jfx+oM28A=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1166,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1166,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":200,"flow_packet_id":1,"flow_first_seen":1431970678985,"flow_last_seen":0,"flow_min_l4_payload_len":28,"flow_max_l4_payload_len":28,"flow_tot_l4_payload_len":28,"flow_avg_l4_payload_len":28,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.16","src_port":13021,"dst_port":40032,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00506{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1167,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1431970679027,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 01092{"flow_id":201,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1167,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":27972,"pkt_caplen":544,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":544,"pkt_l4_len":510,"pkt":"\/\/\/\/\/\/\/\/xCwDBkn+CABFAAISpvoAAEARD93AqAFc\/\/\/\/\/0RcRFwB\/v9VeyJob3N0X2ludCI6IDMzNzUzNTk1OTMsICJ2ZXJzaW9uIjogWzEsIDhdLCAiZGlzcGxheW5hbWUiOiAiIiwgInBvcnQiOiAxNzUwMCwgIm5hbWVzcGFjZXMiOiBbMTQ4MTkzMzcsIDE3NjA5OTYzLCAyMDY0OTM0OSwgMjg1MjE2MDcsIDU4MzQ0OTk2LCA2MDU5NDk4MywgNjQ0MzYwOTksIDk2ODUzMjI0LCA5OTQ2OTc3MywgMTAxMDQ3OTk2LCAxMDgxNTkxMDIsIDEyNTU0MDU2NiwgMTc2OTY0MzA3LCAyNDM2ODI5ODYsIDI0NzkyNTA4NSwgMjYwNDY1MjYxLCAyNzA0MDQ3NDIsIDI4Mzg2MTQ1NywgNDI0NTQwMTk3LCA0NDgzOTczOTMsIDQ1MTQ3MjY1OCwgNTExNzA2NjQyLCA1NjgzOTU4MzMsIDU5NDI0Njk1NCwgNTk4MDYxMDY2LCA2MTU5ODMzNzksIDcyMDA1ODM2MSwgNzM1MDUxODMwLCA3MzYzNDE1MjgsIDc0MTI1NTYxMywgNzc2MDg3MjQ3LCA3ODA4NzA1ODEsIDc4Mjk4MTk0OSwgNzg1MjY2MTc3LCA4MTg3NTI3MTAsIDg1NTY4MjM5MCwgODg0MTIwMTMyLCA5MDg5MTQ4NjhdfQ=="} 00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1167,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":201,"flow_packet_id":1,"flow_first_seen":1431970679027,"flow_last_seen":0,"flow_min_l4_payload_len":502,"flow_max_l4_payload_len":502,"flow_tot_l4_payload_len":502,"flow_avg_l4_payload_len":502,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.92","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","ndpi": {"proto":"Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -1230,30 +1230,30 @@ 00421{"flow_id":75,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1176,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":567725,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAoD41AAEAGr27AqAEib91KLcgoAbtIes\/7AAAAAFAEAABRsgAA"} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1179,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60413,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00469{"flow_id":203,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1179,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":839799,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABK0kgAAEARJOfAqAEiwKgBAev9ADUANqf\/XW0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAAAEAAQ=="} -00673{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1179,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60413,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst0.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00679{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1179,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60413,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst0.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1180,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64364,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00468{"flow_id":204,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1180,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":839976,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKzS8AAEARKgDAqAEiwKgBAftsADUANoJ0c24BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAABwAAQ=="} -00674{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1180,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64364,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst0.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00680{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1180,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":204,"flow_packet_id":1,"flow_first_seen":1431970679839,"flow_last_seen":0,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":46,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64364,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"335.0.7.7.3.rst0.r.skype.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":28,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00449{"flow_id":147,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1181,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":871076,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8RfhAAEAGdY7AqAEib91Njsg4nE30S7wpxRcMPYAYECn7nQAAAQEICj4yNpdNkBTphTv5WfSZuu0="} 00502{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1182,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":205,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1182,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":995024,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"0NQSxnP1PBXCt3IOCABFAAA7shQAAEARfXbAqAEi1cezlTLdnF4AJ7D1e68CWBP9byLKqG9T\/ZSkhpqmfvjcm+3DFpOZwv2yxQ=="} -00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1182,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1182,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":205,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.149","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1183,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":206,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1183,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970679,"pkt_ts_usec":995025,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA12TQAAEARDmTAqAEinTg0HTLdnEoAIVxje7ECiU\/XVCamnPFSSydeUAuZRUP3ucHK0w=="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1183,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1183,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":206,"flow_packet_id":1,"flow_first_seen":1431970679995,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.29","src_port":13021,"dst_port":40010,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00437{"flow_id":120,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1186,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970680,"pkt_ts_usec":340618,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0rbJAADYGF7tv3U2vwKgBIgG7yDJl2k6modh+KIARAB3sngAAAQEICk2j97g+Meis"} 00469{"flow_id":203,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1187,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970680,"pkt_ts_usec":899172,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKn9sAAEARV1TAqAEiwKgBAev9ADUANqf\/XW0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAAAEAAQ=="} 00468{"flow_id":204,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1188,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970680,"pkt_ts_usec":899366,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKCR0AAEAR7hLAqAEiwKgBAftsADUANoJ0c24BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAABwAAQ=="} 00512{"flow_id":192,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1189,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970680,"pkt_ts_usec":982950,"pkt_caplen":119,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":119,"pkt_l4_len":85,"pkt":"0NQSxnP1PBXCt3IOCABFAABpt85AAEAGOCbAqAEinTfrmMhKAbuh9dMOzkYJiIAYECyTjgAAAQEICj4yOuxMXimi86hE3Mf+F71gUhXfICsOYAQVmYXa6zVmVAN\/UCwMTk1xoRWYRdaWkDsfzScQ6Y1RzsI3trk="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1190,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00451{"flow_id":207,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1190,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":5016,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA2XQAAEARDgvAqAEinTg0KzLdnEYALMh9e7MC2jL0tZM0Yzvr0KHAzi3oveeicB3qmta1c4OVExZFkpM\/"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1190,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1190,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":207,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":36,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.43","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1191,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00438{"flow_id":208,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1191,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":5017,"pkt_caplen":67,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":67,"pkt_l4_len":33,"pkt":"0NQSxnP1PBXCt3IOCABFAAA1sl0AAEARTKHAqAEib91KEjLdgQkAIR6we7UCnzLS60tunXakNuMsocCUgSoxAT5iGw=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1191,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1191,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":208,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":25,"flow_max_l4_payload_len":25,"flow_tot_l4_payload_len":25,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":13021,"dst_port":33033,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1192,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40030,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":209,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1192,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":5017,"pkt_caplen":77,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":77,"pkt_l4_len":43,"pkt":"0NQSxnP1PBXCt3IOCABFAAA\/HVAAAEARe03AqAEiQTffDzLdnF4AK6Bke7cC41QXoMCqTrFc3jjyFt76m6sxlqO9wK+EPcEKNtA\/tkI="} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1192,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1192,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":209,"flow_packet_id":1,"flow_first_seen":1431970681005,"flow_last_seen":0,"flow_min_l4_payload_len":35,"flow_max_l4_payload_len":35,"flow_tot_l4_payload_len":35,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.15","src_port":13021,"dst_port":40030,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00520{"flow_id":159,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1193,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":249913,"pkt_caplen":126,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":126,"pkt_l4_len":92,"pkt":"0NQSxnP1PBXCt3IOCABFAABwHH1AAEAG017AqAEinTfrqsg9AbvoZ1rM+umGlIAYECweUgAAAQEICj4yO\/ZMVnGKp9iYwrlcLUTfptpUQ9HnlFyq2KvXjkAGnxSlIXPZFxPNf26I7IG6HpdVzoKbtM+2y58XZOdHADBnVSgw"} 00469{"flow_id":178,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1194,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":303889,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABM2ZVAAEAG5VzAqAEib91KEshEAbuPHWXUImhLeYAYECwUdwAAAQEICj4yPCtNdq638u7zvxiLk1N\/bk90UuwO7GFozw5RA+4e"} 00450{"flow_id":175,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1195,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":446130,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8cPtAAEAGTgfAqAEib91KEshDnFkB\/oa5lZep1YAYECgohwAAAQEICj4yPLlNdq00xUaEJw2DyPo="} @@ -1263,10 +1263,10 @@ 00468{"flow_id":204,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1199,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":909798,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKbIIAAEARiq3AqAEiwKgBAftsADUANoJ0c24BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAABwAAQ=="} 00502{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1200,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.144","src_port":13021,"dst_port":40009,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":210,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1200,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":960901,"pkt_caplen":69,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":69,"pkt_l4_len":35,"pkt":"0NQSxnP1PBXCt3IOCABFAAA3frUAAEARsN7AqAEi1cezkDLdnEkAIwRMe7kCZypNkc74yL7GF7GC5QinylqI\/WPnVsk+"} -00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1200,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.144","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1200,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":210,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":27,"flow_max_l4_payload_len":27,"flow_tot_l4_payload_len":27,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.144","src_port":13021,"dst_port":40009,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1201,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40025,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":211,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1201,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970681,"pkt_ts_usec":960902,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBaTkAAEARlaPAqAEib91KKDLdnFkALS1Je7sCEGG8jv3asKVduW1KlINShpl5CYZ6daDh4AHUflFCiwcMag=="} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1201,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1201,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":211,"flow_packet_id":1,"flow_first_seen":1431970681960,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.40","src_port":13021,"dst_port":40025,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00436{"flow_id":146,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1202,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":15869,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0dXdAAEAG47zAqAEinTeCjsg3nEXoG0gMyGJx5oARECo0XgAAAQEICj4yPvJOwLXQ"} 00436{"flow_id":158,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1203,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":15970,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0HVdAAEAGO93AqAEinTeCjsg8AbsAEWrXQyFuW4ARECwbXAAAAQEICj4yPvJOwLdi"} 00436{"flow_id":147,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1204,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":16048,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0hSdAAEAGNmfAqAEib91Njsg4nE30S7wxxRcMPYARECkhZwAAAQEICj4yPvJNkBTp"} @@ -1317,10 +1317,10 @@ 00454{"flow_id":215,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1216,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":971895,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABARUhAAEAGeZjAqAEib91KMMhPnEhg80NCAAAAALAC\/\/8xegAAAgQFtAEDAwUBAQgKPjJCqwAAAAAEAgAA"} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1217,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00440{"flow_id":216,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1217,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":972023,"pkt_caplen":68,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":68,"pkt_l4_len":34,"pkt":"0NQSxnP1PBXCt3IOCABFAAA2ToQAAEARSoLAqAEinTeCrzLdnEYAIsBye70C0WV2Jw2JJv9T381tb7aFs7ugTny6Jk4="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1217,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1217,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":216,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":26,"flow_max_l4_payload_len":26,"flow_tot_l4_payload_len":26,"flow_avg_l4_payload_len":26,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.175","src_port":13021,"dst_port":40006,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1218,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00457{"flow_id":217,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1218,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970682,"pkt_ts_usec":972023,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBmw8AAEARYEjAqAEib91NrTLdnEwALft7e78CS2barOC4bSdle3ySCU4isieKFyYrhir3D1S\/zus1mmpuRQ=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1218,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1218,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":217,"flow_packet_id":1,"flow_first_seen":1431970682972,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.173","src_port":13021,"dst_port":40012,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00447{"flow_id":212,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1220,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":43958,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADYG+iedN+uSwKgBIpxVyEzh8Ob8VQdrFqASOJAqmgAAAgQFrAQCCApMYN9LPjJCqwEDAwk="} 00436{"flow_id":212,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1221,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":44063,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0JNdAAEAGy1jAqAEinTfrkshMnFVVB2sW4fDm\/YAQECyBfAAAAQEICj4yQvNMYN9L"} 00533{"flow_id":212,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1222,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":44604,"pkt_caplen":133,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":133,"pkt_l4_len":99,"pkt":"0NQSxnP1PBXCt3IOCABFAAB3Mo1AAEAGvV\/AqAEinTfrkshMnFVVB2sW4fDm\/YAYECzPowAAAQEICj4yQvNMYN9LG\/ElW63KxOao8VKmuRdmcRFihQOEgdmeqxt9tl+ffCv6XLznEh5tysSzRUGu2IKGHne8\/QpziFm2LxR1IqtgUU7nbA=="} @@ -1348,13 +1348,13 @@ 00454{"flow_id":215,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1246,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":978082,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAGihAAEAGpLjAqAEib91KMMhPnEhg80NCAAAAALAC\/\/8tkQAAAgQFtAEDAwUBAQgKPjJGlAAAAAAEAgAA"} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1247,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40023,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":218,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1247,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":987836,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8i9IAAEARpC3AqAEinTfrrzLdnFcAKG0ve8ECvWqBesxtVN\/+FF8A8FJFXO0bTxFAGhtLbx9IUYU="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1247,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1247,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":218,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.175","src_port":13021,"dst_port":40023,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1248,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":219,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1248,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":987837,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0Ni4AAEARsXfAqAEinTg0ETLdnE0AIDQfe8MCmFcjIzVltOuGOdvvgZmibnosxcEh"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1248,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1248,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":219,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.17","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1249,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":220,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1249,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970683,"pkt_ts_usec":987900,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0PqwAAEARIpXAqAEiQAQXqjLdnEsAIM3ke8UC93ejJq9SbNcOBlZBFwBC35pf1nt9"} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1249,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1249,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":220,"flow_packet_id":1,"flow_first_seen":1431970683987,"flow_last_seen":0,"flow_min_l4_payload_len":24,"flow_max_l4_payload_len":24,"flow_tot_l4_payload_len":24,"flow_avg_l4_payload_len":24,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.170","src_port":13021,"dst_port":40011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00448{"flow_id":212,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1250,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":69368,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA84vRAAEAGDTPAqAEinTfrkshMnFVVB2tZ4fDnQYAYECluegAAAQEICj4yRu9MYN9f7d463h6NxxM="} 00450{"flow_id":213,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1251,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":152100,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8Jt5AAEAGyT\/AqAEinTfrnMhNnFpJkZ6byTsrQ4AYEChkhAAAAQEICj4yR0FMXOPPdjjDMntxC5I="} 00448{"flow_id":215,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1252,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":268798,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADcGx+Rv3UowwKgBIpxIyE81se9IYPNDQ6ASOJCdPQAAAgQFrAQCCApNifogPjJCqwEDAwk="} @@ -1397,13 +1397,13 @@ 00449{"flow_id":212,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1285,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":995805,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8WuNAAEAGlUTAqAEinTfrkshMnFVVB2tZ4fDnQYAYEClq4gAAAQEICj4ySodMYN9f7d463h6NxxM="} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1286,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":225,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1286,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":997599,"pkt_caplen":64,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":64,"pkt_l4_len":30,"pkt":"0NQSxnP1PBXCt3IOCABFAAAyBX4AAEARk57AqAEinTeCnTLdnE0AHhvPe8cCM2e01AKVV7JkJRCi7OoE7P+SqQ=="} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1286,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1286,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":225,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":22,"flow_max_l4_payload_len":22,"flow_tot_l4_payload_len":22,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.157","src_port":13021,"dst_port":40013,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1287,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00449{"flow_id":226,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1287,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":997600,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8MWwAAEARL9zAqAEiQAQXmzLdnEQAKCm\/e8kCIw7UNc1vAeAYbNVJreKXHNKN8e8UIdCt8moAbvU="} -00538{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1287,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1287,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":226,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":32,"flow_max_l4_payload_len":32,"flow_tot_l4_payload_len":32,"flow_avg_l4_payload_len":32,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"64.4.23.155","src_port":13021,"dst_port":40004,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1288,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00456{"flow_id":227,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1288,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970684,"pkt_ts_usec":997661,"pkt_caplen":79,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":79,"pkt_l4_len":45,"pkt":"0NQSxnP1PBXCt3IOCABFAABBr7UAAEARf9fAqAEi1cezjTLdnE8ALaWJe8sCd26eaxqppENRG4WXSuPXFKjQruFJphoXGEqS7tX7w9Yk1Q=="} -00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1288,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1288,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":227,"flow_packet_id":1,"flow_first_seen":1431970684997,"flow_last_seen":0,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":37,"flow_tot_l4_payload_len":37,"flow_avg_l4_payload_len":37,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.141","src_port":13021,"dst_port":40015,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00467{"flow_id":204,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1289,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970685,"pkt_ts_usec":1537,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABK\/5kAAEAR95XAqAEiwKgBAftsADUANoJ0c24BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAABwAAQ=="} 00467{"flow_id":203,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1290,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970685,"pkt_ts_usec":1625,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKlSsAAEARYgTAqAEiwKgBAev9ADUANqf\/XW0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAAAEAAQ=="} 00450{"flow_id":146,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1291,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970685,"pkt_ts_usec":127027,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8XEBAAEAG\/OvAqAEinTeCjsg3nEXoG0gEyGJx5oAZECqAhAAAAQEICj4ySwpOwLXQr3KT27Tir4g="} @@ -1484,16 +1484,16 @@ 00429{"flow_id":234,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1382,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":201898,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":20,"pkt":"PBXCt3IO0NQSxnP1CABFAAAorxpAAPQG365bvtp9wKgBIgG7yFakF93h\/YIvB1AUJeUZUAAAAAAAAAAA"} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1384,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":1,"flow_first_seen":1431970687261,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"174.49.171.224","src_port":13021,"dst_port":32011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":235,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1384,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":261985,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuS7AAAEAREzPAqAEirjGr4DLdfQsAGuTOfB8CfeyODsgiOuU1SIeok9yn"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1384,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":1,"flow_first_seen":1431970687261,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"174.49.171.224","src_port":13021,"dst_port":32011,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1384,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":1,"flow_first_seen":1431970687261,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"174.49.171.224","src_port":13021,"dst_port":32011,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1385,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"83.31.12.173","src_port":13021,"dst_port":23939,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":236,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1385,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":262047,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAurJcAAEARrJHAqAEiUx8MrTLdXYMAGpfYfCECZ7K5p+bX8n+OJOOTrcyv"} -00539{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1385,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"83.31.12.173","src_port":13021,"dst_port":23939,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1385,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":236,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"83.31.12.173","src_port":13021,"dst_port":23939,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00501{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1386,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.138.161.88","src_port":13021,"dst_port":19521,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":237,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1386,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":262067,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuSakAAEAREGnAqAEivYqhWDLdTEEAGhcdfCMC1zNoLOVTJhFFmEsFrmck"} -00541{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1386,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.138.161.88","src_port":13021,"dst_port":19521,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1386,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":237,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.138.161.88","src_port":13021,"dst_port":19521,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00502{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1387,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.188.134.174","src_port":13021,"dst_port":22436,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":238,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1387,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":262098,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuOf4AAEAROozAqAEivbyGrjLdV6QAGoKkfCUCWKDpreHeWqMtL4LNh6CD"} -00542{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1387,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.188.134.174","src_port":13021,"dst_port":22436,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1387,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":238,"flow_packet_id":1,"flow_first_seen":1431970687262,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"189.188.134.174","src_port":13021,"dst_port":22436,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00503{"flow_id":223,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1388,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":337958,"pkt_caplen":114,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":114,"pkt_l4_len":80,"pkt":"0NQSxnP1PBXCt3IOCABFAABkxTpAAEAGW+zAqAEiQAQXn8hSAbvNFjuOa1gmPIAZECyYNgAAAQEICj4yU5ZMR9pGOm9QiCGp0cwW6vp4r5Dn8\/7YY8lRGP7REcP1BqFDpRTD4qb3sZ4E9ti6rTGePCt6"} 00422{"flow_id":230,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1399,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":666142,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"0NQSxnP1PBXCt3IOCABFAAAo51IAAEARD\/\/AqAEiwKgBAeasFOcAFAzzAAEAADLdMt0AAA4Q"} 00462{"flow_id":231,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1404,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":668942,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"PBXCt3IO0NQSxnP1CABFwABElsAAAEABX8XAqAEBwKgBIgMDgJYAAAAARQAAKOdSAABAEQ\/\/wKgBIsCoAQHmrBTnABQM8wABAAAy3TLdAAAOEA=="} @@ -1524,7 +1524,7 @@ 00437{"flow_id":147,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1435,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970687,"pkt_ts_usec":998806,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0Hx5AADcGpXBv3U2OwKgBIpxNyDjFFwxF9Eu8KYARAB1V6gAAAQEICk2QKO8+MgZ1"} 00498{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1439,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431970688025,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.14","src_port":13021,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00427{"flow_id":242,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1439,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":25302,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAuOK8AAEARxlrAqAEib91KDjLdAbsAGqZSfFUC4vleo7UvMvPmsU4YCKBd"} -00595{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1439,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431970688025,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.14","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00601{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1439,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":242,"flow_packet_id":1,"flow_first_seen":1431970688025,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.14","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00469{"flow_id":178,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1440,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":51220,"pkt_caplen":90,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":90,"pkt_l4_len":56,"pkt":"0NQSxnP1PBXCt3IOCABFAABMImpAAEAGnIjAqAEib91KEshEAbuPHWXUImhLeYAZECz6TQAAAQEICj4yVlNNdq638u7zvxiLk1N\/bk90UuwO7GFozw5RA+4e"} 00467{"flow_id":204,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1441,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":53940,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKaYcAAEARjajAqAEiwKgBAftsADUANoJ0c24BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAABwAAQ=="} 00469{"flow_id":203,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1442,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":54034,"pkt_caplen":88,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":88,"pkt_l4_len":54,"pkt":"0NQSxnP1PBXCt3IOCABFAABKe8AAAEARe2\/AqAEiwKgBAev9ADUANqf\/XW0BAAABAAAAAAAAAzMzNQEwATcBNwEzBHJzdDABcgVza3lwZQNuZXQAAAEAAQ=="} @@ -1537,7 +1537,7 @@ 00448{"flow_id":239,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1451,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":237097,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8HstAAEAGbHnAqAEiTKehBshYTzLHdCYHEv4ezoAYECqQygAAAQEICj4yVwq+r7k1zWOVyLN8y6I="} 00499{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1458,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431970688320,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.141","src_port":13021,"dst_port":443,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":243,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1458,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":320038,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAukPgAAEARnzfAqAEinTfrjTLdAbsAGuidfHYCyiJR+IygHiSHdyp3P0rG"} -00596{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1458,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431970688320,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.141","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00602{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1458,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":243,"flow_packet_id":1,"flow_first_seen":1431970688320,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.141","src_port":13021,"dst_port":443,"l4_proto":"udp","ndpi": {"flow_risk": {"5":"Known protocol on non standard port"},"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00449{"flow_id":241,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1462,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":347281,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA81axAAEAG4m\/AqAEiBfi63chaeSLm2Z7HnfKa24AYECiVrgAAAQEICj4yV3UAAJTxinTTcj1jiGY="} 00481{"flow_id":222,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1468,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":417497,"pkt_caplen":99,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":99,"pkt_l4_len":65,"pkt":"0NQSxnP1PBXCt3IOCABFAABVYx5AAEAGjObAqAEinTfrnMhRAbsdDAEeNXDb94AZECxNwgAAAQEICj4yV7pMXOVgRJ52DFIu7cAK7Gpc8dNzIO4YY2vVOHQu5N+2IqCrL00y"} 00492{"flow_id":221,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1469,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970688,"pkt_ts_usec":417499,"pkt_caplen":104,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":104,"pkt_l4_len":70,"pkt":"0NQSxnP1PBXCt3IOCABFAABai7JAAEAGZFfAqAEinTfrkshQAbtIMwmq6zPtWYAZECxt+AAAAQEICj4yV7pMYODx4TzV3\/Y4WDPH3tpvaLZcP8pol15k+DSkUSs81WKefnkA99PxSe0="} @@ -1609,9 +1609,9 @@ 00437{"flow_id":245,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1567,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":35437,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0rv1AAHMGR0NH7gfLwKgBIklPyFwwtyQL6QVekYAQ\/6FQNQAAAQEICgMcyZg+Mlx2"} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1570,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_first_seen":1431970690133,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00460{"flow_id":248,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1570,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":133876,"pkt_caplen":82,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":82,"pkt_l4_len":48,"pkt":"0NQSxnP1PBXCt3IOCABFAABEeJ0AAEARfpjAqAEiwKgBAemMADUAMK9udVgBAAABAAAAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAQ=="} -00667{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1570,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_first_seen":1431970690133,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} +00673{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1570,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":1,"flow_first_seen":1431970690133,"flow_last_seen":0,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":40,"flow_tot_l4_payload_len":40,"flow_avg_l4_payload_len":40,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} 00480{"flow_id":248,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1573,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":190958,"pkt_caplen":98,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":98,"pkt_l4_len":64,"pkt":"PBXCt3IO0NQSxnP1CABFAABUAABAAEARtyXAqAEBwKgBIgA16YwAQDU7dViBgAABAAEAAAAABWU0NTkzAWcKYWthbWFpZWRnZQNuZXQAAAEAAcAMAAEAAQAAAAsABBfOIaY="} -00693{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1573,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":1431970690133,"flow_last_seen":1431970690190,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} +00699{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":1573,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":1431970690133,"flow_last_seen":1431970690190,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"e4593.g.akamaiedge.net","num_queries":1,"num_answers":1,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"23.206.33.166"}} 00494{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1574,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":1,"flow_first_seen":1431970690191,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51295,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00455{"flow_id":249,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1574,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":191533,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABA15NAAEAGZ+bAqAEiF84hpshfAbtO4sWoAAAAALAC\/\/\/AXwAAAgQFtAEDAwUBAQgKPjJehwAAAAAEAgAA"} 00437{"flow_id":247,"flow_packet_id":13,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1575,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":206670,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"PBXCt3IO0NQSxnP1CABFAAA0CChAAHQGnfFRU02NwKgBIkTnyF6euo+HZ6uFl4AQAP85vgAAAQEICgC8Fko+Ml1S"} @@ -1619,7 +1619,7 @@ 00448{"flow_id":249,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1577,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":235132,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"PBXCt3IO0NQSxnP1CABFAAA8AABAADkGRn4XziGmwKgBIgG7yF8ZBQnnTuLFqaASOJBGLgAAAgQFrAQCCArsPkNyPjJehwEDAwU="} 00436{"flow_id":249,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1578,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":235236,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"0NQSxnP1PBXCt3IOCABFAAA0z6tAAEAGb9rAqAEiF84hpshfAbtO4sWpGQUJ6IAQECydKQAAAQEICj4yXrLsPkNy"} 00666{"flow_id":249,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1579,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":235915,"pkt_caplen":233,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":233,"pkt_l4_len":199,"pkt":"0NQSxnP1PBXCt3IOCABFAADbrhlAAEAGkMXAqAEiF84hpshfAbtO4sWpGQUJ6IAYECzJfgAAAQEICj4yXrLsPkNyFgMBAKIBAACeAwFVWiOCVbYrRciiFbDPyo4FvK6EfrMUp8GvYuL\/j8yxbgAATAD\/VgDAJMAjwArACcAIwCjAJ8AUwBPAEsAmwCXABcAEwAPAKsApwA\/ADsANAGsAZwA5ADMAFgA9ADwANQAvAArAB8ARwALADAAFAAQBAAApAAAAEwARAAAOYXBwcy5za3lwZS5jb20ACgAIAAYAFwAYABkACwACAQA="} -00774{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1579,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":4,"flow_first_seen":1431970690191,"flow_last_seen":1431970690235,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51295,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"apps.skype.com","ja3":"3d49c0a7161d6636fcb6973f14e05046","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00780{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":1579,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":4,"flow_first_seen":1431970690191,"flow_last_seen":1431970690235,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":167,"flow_avg_l4_payload_len":41,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51295,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"7":"Obsolete TLS version (< 1.1)"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1","client_requested_server_name":"apps.skype.com","ja3":"3d49c0a7161d6636fcb6973f14e05046","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 01972{"flow_id":247,"flow_packet_id":15,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1580,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":333177,"pkt_caplen":1190,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1190,"pkt_l4_len":1156,"pkt":"PBXCt3IO0NQSxnP1CABFAASYCC9AAHQGmYZRU02NwKgBIkTnyF6euo+HZ6uFm4AYAP9vFQAAAQEICgC8FlY+Ml6WZA1g8kk3GRuW+KdN6BJiQG9J69exPkyGs0ohXWvcAnmDzlQx3ARJW5a\/NMvmkXHzZrnkSO+cYBxS+HHmrSjMf9WXi8xCwDYqSxEsxcOXx5vfgrn3i6sOTtn+VIggdKtv8l0YwS7cBkFvJuBhz1ZB03Yelzn+JZ\/EwEhl861pnKSOIj0SlnN6Ucn6o2kFZ8MvUPzVs5akmAtSdBkw5wGbhMiPlAsgmEROrUJq8QL7cUIs5VtRE38r+u7uOSviuIKzgV45OgzuEtzVzWiqeGlboSATHAFcolwRwCJsLJ56+T5pe2irWd6YTymhpmuEJHUoOrWdA15yfKX2\/LfLr5vuv6mdQuNSEDffkAHQZOmQj4pr2wxAVUEwi0iXuSuoggqgYSMVyL\/1+EsC8Gj58\/jy6zpzZa6jLRP0FlqYD\/kc\/c1Rz\/5M7ydbSzwHlpt4RInMaFzDO9QKjtCKqJwp417ZVPnvnGODc\/9BbXUPAkG0P9ABebCPKUHek9gSIv8FrGQqd5bGAEBO6qb8iVdU9gPCC4vtzmWduKwbsf\/fUENnbDWZlDUiLst6t5OH1UlwuLbGoan8+GykB\/V5yI3\/mo0YvFhY59jFrjPg0y6ZHrZ0X9mPiCc8bpC8a+OXbuOEtwvoCadGhesO6pdBVWvhqrDdfB9YrifFI6gnnI4zDOJG6AT3gn+brq7P6qvY\/aXN0MJeSHRTO8fi4UYACLQxefEBocbn6ph1l+zzY+OU\/XCYve0HNpisxsphLsjR2ybXm5Jws6kxpr0XUMLkJIuv5wk5AJl6dYTvXtHc4EcXaawHTY8qL4aNG58iheg6Iz6k8gYyKPYm12dYc0ZMNyRAxp+26L\/HaKuFDdZAxHxK\/V1LSG54qKeG3HtEI4JDGO2jO4HKX1M+\/7X6UdODTuC6cPSCTpseicKMqzdEQ+Y7itD+RR\/IVvbHGRiBDvIPsnJNmz0Nmh+xLOHnOWaDlTC3c7idHCWcSgEy9oZsR71JjHjnb+c6joR4MalTrmmjinxHJRgAZG37paIiBxqdVUJ8z+SUf0x0hUYH5S8aq4D3xRtsoFbSymyv3ZHr+ZhpN\/7ZLdq8jzl3DAH4\/ql8jU2zPJGuj3XZ4WId\/\/Eg75ZoN\/A7z036pB5QlVZWNVzSaMDMw+GI7MxklsSJ5D9IG\/r7XTMnDOjlR52fUn4cAeII0ypdoxOrqOtfZ\/eHNjj1E7LpV1vdL9emUQR7HsYjMc6Q6nmzn\/RA4ERci2vskCRr4GvqtPGgphmNH9boDKLkX3J0Jg966lJJnjyUaDpG8W8HKl5CidnLzMlhipj71z+4P43t\/IAjaSd5SzsEWoj6KCFHaJc3UyUSnHEydmWcXflIJTTREgfPpP3SDpgorfOHczhAo7b4n75SO+z9x3297AaYh5+btRw0SkKxPkqqk1k6CCcJG59y\/fr63wHObnGNYR1h47yWAx33eRhH3LAEnm04knA\/+hCxBGyaeUj5oavl2Rif+iRPaLk="} 00449{"flow_id":241,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1581,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":333196,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8mLNAAEAGH2nAqAEiBfi63chaeSLm2Z7HnfKa24AZECiODwAAAQEICj4yXxMAAJTxinTTcj1jiGY="} 00449{"flow_id":213,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1594,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970690,"pkt_ts_usec":556703,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8XFFAAEAGk8zAqAEinTfrnMhNnFpJkZ6byTsrQ4AZEChL2wAAAQEICj4yX+lMXOPPdjjDMntxC5I="} @@ -1986,22 +1986,22 @@ 00450{"flow_id":270,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2126,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970707,"pkt_ts_usec":636184,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA86y5AAEAGsP3AqAEi1KEIJMh2NFCv5GjhqQ98OIAYECmm\/QAAAQEICj4yofo\/p5PX6wz3Jw7OQXM="} 00500{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431970707911,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"133.236.67.25","src_port":13021,"dst_port":49195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00428{"flow_id":271,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970707,"pkt_ts_usec":911507,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"0NQSxnP1PBXCt3IOCABFAAAu+nsAAEAR9XPAqAEihexDGTLdwCsAGiMOfdMCo1rvIegrMqRysYXm5vlz"} -00540{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431970707911,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"133.236.67.25","src_port":13021,"dst_port":49195,"l4_proto":"udp","ndpi": {"proto":"Skype.SkypeCall","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2131,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431970707911,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"133.236.67.25","src_port":13021,"dst_port":49195,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams.SkypeCall","breed":"Acceptable","category":"VoIP"}} 00450{"flow_id":270,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2132,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":204706,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8ct5AAEAGKU7AqAEi1KEIJMh2NFCv5GjhqQ98OIAYECmkxgAAAQEICj4ypDE\/p5PX6wz3Jw7OQXM="} 00451{"flow_id":263,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2134,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":272876,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8xlJAAEAGdJ\/AqAEiXU\/gsMhvOKrhhkX0fWkiXIAZECl4zgAAAQEICj4ypHUANM5rAJngurdz24A="} 00450{"flow_id":265,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2144,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":429074,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA84MtAAEAGu2DAqAEi1KEIJMhxNFBceQ04qm6w0IAZEClcngAAAQEICj4ypRE\/pB5axn8ujwJhcPA="} 00495{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":2145,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":272,"flow_packet_id":1,"flow_first_seen":1431970708715,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"212.161.8.36","src_port":51319,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00454{"flow_id":272,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2145,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":715662,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"0NQSxnP1PBXCt3IOCABFAABAWHtAAEAGQ63AqAEi1KEIJMh3NFBvQ5mUAAAAALAC\/\/+uawAAAgQFtAEDAwUBAQgKPjKmLwAAAAAEAgAA"} 00450{"flow_id":268,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1431970708,"pkt_ts_usec":726988,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"0NQSxnP1PBXCt3IOCABFAAA8s5VAAEAGEEDAqAEilQ0gD8h0NFB7qA9PDQLVqIAZEChN9AAAAQEICj4ypjo\/gOaLNT3NT3k1sQY="} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":14,"flow_first_seen":1431970651380,"flow_last_seen":1431970679567,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":441,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51240,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":14,"flow_first_seen":1431970651380,"flow_last_seen":1431970679567,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":441,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51240,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00510{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":14,"flow_first_seen":1431970651380,"flow_last_seen":1431970679567,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":441,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51240,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":14,"flow_first_seen":1431970659480,"flow_last_seen":1431970693361,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":431,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":14,"flow_first_seen":1431970659480,"flow_last_seen":1431970693361,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":431,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":120,"flow_packet_id":14,"flow_first_seen":1431970659480,"flow_last_seen":1431970693361,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":431,"flow_avg_l4_payload_len":30,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51250,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":14,"flow_first_seen":1431970668514,"flow_last_seen":1431970696319,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":321,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51259,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":14,"flow_first_seen":1431970668514,"flow_last_seen":1431970696319,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":321,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51259,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":157,"flow_packet_id":14,"flow_first_seen":1431970668514,"flow_last_seen":1431970696319,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":321,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51259,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":14,"flow_first_seen":1431970673563,"flow_last_seen":1431970703649,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51268,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":14,"flow_first_seen":1431970673563,"flow_last_seen":1431970703649,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51268,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":178,"flow_packet_id":14,"flow_first_seen":1431970673563,"flow_last_seen":1431970703649,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":271,"flow_avg_l4_payload_len":19,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.18","src_port":51268,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_first_seen":1431970684583,"flow_last_seen":1431970684880,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51283,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_first_seen":1431970684583,"flow_last_seen":1431970684880,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51283,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00506{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":224,"flow_packet_id":3,"flow_first_seen":1431970684583,"flow_last_seen":1431970684880,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51283,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00501{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":271,"flow_packet_id":1,"flow_first_seen":1431970707911,"flow_last_seen":0,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":18,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"133.236.67.25","src_port":13021,"dst_port":49195,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":166,"flow_packet_id":7,"flow_first_seen":1431970670304,"flow_last_seen":1431970696803,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":61095,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2015,14 +2015,14 @@ 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":2,"flow_packet_id":7,"flow_first_seen":1431970634276,"flow_last_seen":1431970660781,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":55028,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":249,"flow_packet_id":12,"flow_first_seen":1431970690191,"flow_last_seen":1431970705014,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":167,"flow_tot_l4_payload_len":1336,"flow_avg_l4_payload_len":111,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"23.206.33.166","src_port":51295,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00513{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":8,"flow_first_seen":1431970636044,"flow_last_seen":1431970646741,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":213,"flow_tot_l4_payload_len":590,"flow_avg_l4_payload_len":73,"midstream":1,"l3_proto":"ip4","src_ip":"17.143.160.149","dst_ip":"192.168.1.34","src_port":5223,"dst_port":50407,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":6,"flow_first_seen":1431970686843,"flow_last_seen":1431970687201,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51286,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":6,"flow_first_seen":1431970686843,"flow_last_seen":1431970687201,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51286,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":234,"flow_packet_id":6,"flow_first_seen":1431970686843,"flow_last_seen":1431970687201,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51286,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":155,"flow_packet_id":7,"flow_first_seen":1431970668278,"flow_last_seen":1431970694737,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63342,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00528{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":14,"flow_first_seen":1431970699896,"flow_last_seen":1431970708272,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51311,"dst_port":14506,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":263,"flow_packet_id":14,"flow_first_seen":1431970699896,"flow_last_seen":1431970708272,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":80,"flow_tot_l4_payload_len":190,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51311,"dst_port":14506,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00529{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431970701508,"flow_last_seen":1431970702603,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":323,"flow_tot_l4_payload_len":719,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51314,"dst_port":14506,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00515{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":266,"flow_packet_id":20,"flow_first_seen":1431970701508,"flow_last_seen":1431970702603,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":323,"flow_tot_l4_payload_len":719,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"93.79.224.176","src_port":51314,"dst_port":14506,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":10,"flow_first_seen":1431970693196,"flow_last_seen":1431970706224,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51302,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":10,"flow_first_seen":1431970693196,"flow_last_seen":1431970706224,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51302,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":256,"flow_packet_id":10,"flow_first_seen":1431970693196,"flow_last_seen":1431970706224,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":1,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51302,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00528{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":15,"flow_first_seen":1431970688560,"flow_last_seen":1431970700671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":102,"flow_tot_l4_payload_len":228,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51291,"dst_port":17639,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":244,"flow_packet_id":15,"flow_first_seen":1431970688560,"flow_last_seen":1431970700671,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":102,"flow_tot_l4_payload_len":228,"flow_avg_l4_payload_len":15,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"81.83.77.141","src_port":51291,"dst_port":17639,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -2041,45 +2041,45 @@ 00529{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":15,"flow_first_seen":1431970651380,"flow_last_seen":1431970670192,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":535,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51239,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":15,"flow_first_seen":1431970651380,"flow_last_seen":1431970670192,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":535,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51239,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":15,"flow_packet_id":7,"flow_first_seen":1431970634731,"flow_last_seen":1431970661287,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":53372,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":17,"flow_first_seen":1431970651380,"flow_last_seen":1431970679713,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":576,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51238,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":17,"flow_first_seen":1431970651380,"flow_last_seen":1431970679713,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":576,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51238,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":73,"flow_packet_id":17,"flow_first_seen":1431970651380,"flow_last_seen":1431970679713,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":576,"flow_avg_l4_payload_len":33,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51238,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00529{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":18,"flow_first_seen":1431970687670,"flow_last_seen":1431970703163,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":290,"flow_avg_l4_payload_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51290,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":241,"flow_packet_id":18,"flow_first_seen":1431970687670,"flow_last_seen":1431970703163,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":290,"flow_avg_l4_payload_len":16,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51290,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":15,"flow_first_seen":1431970652388,"flow_last_seen":1431970670585,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":586,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51241,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":15,"flow_first_seen":1431970652388,"flow_last_seen":1431970670585,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":586,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51241,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":81,"flow_packet_id":15,"flow_first_seen":1431970652388,"flow_last_seen":1431970670585,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":586,"flow_avg_l4_payload_len":39,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51241,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00532{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":20,"flow_first_seen":1431970688782,"flow_last_seen":1431970692885,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2561,"flow_avg_l4_payload_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51293,"dst_port":31010,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00518{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":246,"flow_packet_id":20,"flow_first_seen":1431970688782,"flow_last_seen":1431970692885,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1024,"flow_tot_l4_payload_len":2561,"flow_avg_l4_payload_len":128,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"5.248.186.221","src_port":51293,"dst_port":31010,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":15,"flow_first_seen":1431970668514,"flow_last_seen":1431970686964,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":516,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51260,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":15,"flow_first_seen":1431970668514,"flow_last_seen":1431970686964,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":516,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51260,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":158,"flow_packet_id":15,"flow_first_seen":1431970668514,"flow_last_seen":1431970686964,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":516,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51260,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":15,"flow_first_seen":1431970668515,"flow_last_seen":1431970686367,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51261,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":15,"flow_first_seen":1431970668515,"flow_last_seen":1431970686367,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51261,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":159,"flow_packet_id":15,"flow_first_seen":1431970668515,"flow_last_seen":1431970686367,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":571,"flow_avg_l4_payload_len":38,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51261,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00514{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":235,"flow_packet_id":5,"flow_first_seen":1431970687261,"flow_last_seen":1431970707409,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":18,"flow_tot_l4_payload_len":90,"flow_avg_l4_payload_len":18,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"174.49.171.224","src_port":13021,"dst_port":32011,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":15,"flow_first_seen":1431970677603,"flow_last_seen":1431970694432,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":522,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51274,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":15,"flow_first_seen":1431970677603,"flow_last_seen":1431970694432,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":522,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51274,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":192,"flow_packet_id":15,"flow_first_seen":1431970677603,"flow_last_seen":1431970694432,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":522,"flow_avg_l4_payload_len":34,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51274,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702158,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":417,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51280,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702158,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":417,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51280,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":221,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702158,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":417,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51280,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702162,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":382,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51281,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702162,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":382,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51281,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":222,"flow_packet_id":15,"flow_first_seen":1431970684583,"flow_last_seen":1431970702162,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":382,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51281,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":17,"flow_packet_id":2,"flow_first_seen":1431970635433,"flow_last_seen":1431970635489,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":63661,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":16,"flow_first_seen":1431970668515,"flow_last_seen":1431970693321,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":567,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51262,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":160,"flow_packet_id":16,"flow_first_seen":1431970668515,"flow_last_seen":1431970693321,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":72,"flow_tot_l4_payload_len":567,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.176","src_port":51262,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00533{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":15,"flow_first_seen":1431970675578,"flow_last_seen":1431970692134,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":417,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51271,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS","breed":"Safe","category":"Web"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":186,"flow_packet_id":15,"flow_first_seen":1431970675578,"flow_last_seen":1431970692134,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":417,"flow_avg_l4_payload_len":27,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51271,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00541{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":16,"flow_first_seen":1431970649777,"flow_last_seen":1431970678255,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51236,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00547{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":16,"flow_first_seen":1431970649777,"flow_last_seen":1431970678255,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51236,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":61,"flow_packet_id":16,"flow_first_seen":1431970649777,"flow_last_seen":1431970678255,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":193,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.45","src_port":51236,"dst_port":40008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":8,"flow_first_seen":1431970642412,"flow_last_seen":1431970643680,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":229,"flow_tot_l4_payload_len":806,"flow_avg_l4_payload_len":100,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":24,"flow_packet_id":7,"flow_first_seen":1431970642408,"flow_last_seen":1431970643670,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":386,"flow_avg_l4_payload_len":55,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.255","src_port":137,"dst_port":137,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":27,"flow_packet_id":2,"flow_first_seen":1431970642417,"flow_last_seen":1431970643676,"flow_min_l4_payload_len":184,"flow_max_l4_payload_len":184,"flow_tot_l4_payload_len":368,"flow_avg_l4_payload_len":184,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.1","dst_ip":"192.168.1.34","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00512{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":2,"flow_first_seen":1431970642414,"flow_last_seen":1431970643673,"flow_min_l4_payload_len":174,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":348,"flow_avg_l4_payload_len":174,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.255","src_port":138,"dst_port":138,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00519{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":31,"flow_packet_id":2,"flow_first_seen":1431970643964,"flow_last_seen":1431970644121,"flow_min_l4_payload_len":34,"flow_max_l4_payload_len":100,"flow_tot_l4_payload_len":134,"flow_avg_l4_payload_len":67,"midstream":0,"l3_proto":"ip6","src_ip":"fe80::c62c:3ff:fe06:49fe","dst_ip":"ff02::fb","src_port":5353,"dst_port":5353,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":16,"flow_first_seen":1431970666902,"flow_last_seen":1431970694879,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51256,"dst_port":40013,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":16,"flow_first_seen":1431970666902,"flow_last_seen":1431970694879,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51256,"dst_port":40013,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":147,"flow_packet_id":16,"flow_first_seen":1431970666902,"flow_last_seen":1431970694879,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":77,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.142","src_port":51256,"dst_port":40013,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":14,"flow_packet_id":7,"flow_first_seen":1431970634730,"flow_last_seen":1431970661287,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57592,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":16,"flow_first_seen":1431970657867,"flow_last_seen":1431970685617,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":220,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51248,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":16,"flow_first_seen":1431970657867,"flow_last_seen":1431970685617,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":220,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51248,"dst_port":40030,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":109,"flow_packet_id":16,"flow_first_seen":1431970657867,"flow_last_seen":1431970685617,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":220,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.77.175","src_port":51248,"dst_port":40030,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":199,"flow_first_seen":1431970682971,"flow_last_seen":1431970705724,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":77329,"flow_avg_l4_payload_len":388,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51279,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00554{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":199,"flow_first_seen":1431970682971,"flow_last_seen":1431970705724,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":77329,"flow_avg_l4_payload_len":388,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51279,"dst_port":40008,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00520{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":215,"flow_packet_id":199,"flow_first_seen":1431970682971,"flow_last_seen":1431970705724,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":77329,"flow_avg_l4_payload_len":388,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"111.221.74.48","src_port":51279,"dst_port":40008,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":13,"flow_first_seen":1431970672330,"flow_last_seen":1431970689889,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":98,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"111.221.74.18","dst_ip":"192.168.1.34","src_port":40025,"dst_port":51267,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":13,"flow_first_seen":1431970672330,"flow_last_seen":1431970689889,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":98,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"111.221.74.18","dst_ip":"192.168.1.34","src_port":40025,"dst_port":51267,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":175,"flow_packet_id":13,"flow_first_seen":1431970672330,"flow_last_seen":1431970689889,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":98,"flow_tot_l4_payload_len":231,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"111.221.74.18","dst_ip":"192.168.1.34","src_port":40025,"dst_port":51267,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00518{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":229,"flow_packet_id":2,"flow_first_seen":1431970685835,"flow_last_seen":1431970685835,"flow_min_l4_payload_len":132,"flow_max_l4_payload_len":133,"flow_tot_l4_payload_len":265,"flow_avg_l4_payload_len":132,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"239.255.255.250","src_port":58061,"dst_port":1900,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":127,"flow_packet_id":8,"flow_first_seen":1431970660159,"flow_last_seen":1431970690798,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":954,"flow_tot_l4_payload_len":2462,"flow_avg_l4_payload_len":307,"midstream":1,"l3_proto":"ip4","src_ip":"108.160.163.108","dst_ip":"192.168.1.34","src_port":443,"dst_port":51222,"l4_proto":"tcp","ndpi": {"proto":"TLS.Dropbox","breed":"Acceptable","category":"Cloud"}} @@ -2098,9 +2098,9 @@ 00516{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":269,"flow_packet_id":20,"flow_first_seen":1431970705942,"flow_last_seen":1431970706101,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":4880,"flow_avg_l4_payload_len":244,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"149.13.32.15","src_port":51317,"dst_port":13392,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":9,"flow_packet_id":2,"flow_first_seen":1431970634669,"flow_last_seen":1431970634723,"flow_min_l4_payload_len":59,"flow_max_l4_payload_len":124,"flow_tot_l4_payload_len":183,"flow_avg_l4_payload_len":91,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":57694,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00519{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":348,"flow_first_seen":1431970634729,"flow_last_seen":1431970685945,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":158703,"flow_avg_l4_payload_len":456,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.126.211","src_port":51230,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":13,"flow_first_seen":1431970636340,"flow_last_seen":1431970655127,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":13,"flow_first_seen":1431970636340,"flow_last_seen":1431970655127,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":13,"flow_first_seen":1431970636340,"flow_last_seen":1431970655127,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":291,"flow_avg_l4_payload_len":22,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51232,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":14,"flow_first_seen":1431970657448,"flow_last_seen":1431970689704,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":496,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51247,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":14,"flow_first_seen":1431970657448,"flow_last_seen":1431970689704,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":496,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51247,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00510{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":108,"flow_packet_id":14,"flow_first_seen":1431970657448,"flow_last_seen":1431970689704,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":79,"flow_tot_l4_payload_len":496,"flow_avg_l4_payload_len":35,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51247,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":248,"flow_packet_id":2,"flow_first_seen":1431970690133,"flow_last_seen":1431970690190,"flow_min_l4_payload_len":40,"flow_max_l4_payload_len":56,"flow_tot_l4_payload_len":96,"flow_avg_l4_payload_len":48,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59788,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":7,"flow_first_seen":1431970636301,"flow_last_seen":1431970662705,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":51753,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2112,20 +2112,20 @@ 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":60,"flow_packet_id":17,"flow_first_seen":1431970649777,"flow_last_seen":1431970674421,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":85,"flow_tot_l4_payload_len":211,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"65.55.223.45","src_port":51235,"dst_port":40009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":7,"flow_packet_id":7,"flow_first_seen":1431970634591,"flow_last_seen":1431970661089,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":217,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":49864,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00507{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":6,"flow_packet_id":7,"flow_first_seen":1431970634589,"flow_last_seen":1431970661089,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":217,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64240,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":18,"flow_first_seen":1431970649777,"flow_last_seen":1431970680320,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51234,"dst_port":40001,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":18,"flow_first_seen":1431970649777,"flow_last_seen":1431970680320,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51234,"dst_port":40001,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":59,"flow_packet_id":18,"flow_first_seen":1431970649777,"flow_last_seen":1431970680320,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":109,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":14,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.147","src_port":51234,"dst_port":40001,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":156,"flow_packet_id":7,"flow_first_seen":1431970668278,"flow_last_seen":1431970694738,"flow_min_l4_payload_len":36,"flow_max_l4_payload_len":36,"flow_tot_l4_payload_len":252,"flow_avg_l4_payload_len":36,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":64258,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00542{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":17,"flow_first_seen":1431970650785,"flow_last_seen":1431970683130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51237,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00548{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":17,"flow_first_seen":1431970650785,"flow_last_seen":1431970683130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51237,"dst_port":40022,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00513{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":67,"flow_packet_id":17,"flow_first_seen":1431970650785,"flow_last_seen":1431970683130,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":78,"flow_tot_l4_payload_len":194,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.176","src_port":51237,"dst_port":40022,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":17,"flow_first_seen":1431970666902,"flow_last_seen":1431970699651,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":186,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51255,"dst_port":40005,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":17,"flow_first_seen":1431970666902,"flow_last_seen":1431970699651,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":186,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51255,"dst_port":40005,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":146,"flow_packet_id":17,"flow_first_seen":1431970666902,"flow_last_seen":1431970699651,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":70,"flow_tot_l4_payload_len":186,"flow_avg_l4_payload_len":10,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.130.142","src_port":51255,"dst_port":40005,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":18,"flow_first_seen":1431970666903,"flow_last_seen":1431970694442,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":101,"flow_tot_l4_payload_len":224,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51257,"dst_port":40032,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":18,"flow_first_seen":1431970666903,"flow_last_seen":1431970694442,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":101,"flow_tot_l4_payload_len":224,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51257,"dst_port":40032,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00515{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":148,"flow_packet_id":18,"flow_first_seen":1431970666903,"flow_last_seen":1431970694442,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":101,"flow_tot_l4_payload_len":224,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.170","src_port":51257,"dst_port":40032,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970700372,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51276,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970700372,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51276,"dst_port":40021,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":212,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970700372,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":68,"flow_tot_l4_payload_len":199,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.146","src_port":51276,"dst_port":40021,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":17,"flow_first_seen":1431970675992,"flow_last_seen":1431970693146,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":237,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51272,"dst_port":40029,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":17,"flow_first_seen":1431970675992,"flow_last_seen":1431970693146,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":237,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51272,"dst_port":40029,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":187,"flow_packet_id":17,"flow_first_seen":1431970675992,"flow_last_seen":1431970693146,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":92,"flow_tot_l4_payload_len":237,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.152","src_port":51272,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970695489,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":296,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51277,"dst_port":40026,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970695489,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":296,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51277,"dst_port":40026,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00515{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":213,"flow_packet_id":17,"flow_first_seen":1431970682971,"flow_last_seen":1431970695489,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":105,"flow_tot_l4_payload_len":296,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.55.235.156","src_port":51277,"dst_port":40026,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00524{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":4,"flow_first_seen":1431970685835,"flow_last_seen":1431970687666,"flow_min_l4_payload_len":12,"flow_max_l4_payload_len":12,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59052,"dst_port":5351,"l4_proto":"udp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00510{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":230,"flow_packet_id":4,"flow_first_seen":1431970685835,"flow_last_seen":1431970687666,"flow_min_l4_payload_len":12,"flow_max_l4_payload_len":12,"flow_tot_l4_payload_len":48,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":59052,"dst_port":5351,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -2136,9 +2136,9 @@ 00515{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":179,"flow_packet_id":19,"flow_first_seen":1431970673966,"flow_last_seen":1431970700297,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":98,"flow_tot_l4_payload_len":223,"flow_avg_l4_payload_len":11,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"213.199.179.175","src_port":51269,"dst_port":40029,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":20,"flow_packet_id":7,"flow_first_seen":1431970636300,"flow_last_seen":1431970662705,"flow_min_l4_payload_len":47,"flow_max_l4_payload_len":47,"flow_tot_l4_payload_len":329,"flow_avg_l4_payload_len":47,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":50055,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00509{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":203,"flow_packet_id":7,"flow_first_seen":1431970679839,"flow_last_seen":1431970706169,"flow_min_l4_payload_len":46,"flow_max_l4_payload_len":46,"flow_tot_l4_payload_len":322,"flow_avg_l4_payload_len":46,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"192.168.1.1","src_port":60413,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1431970634728,"flow_last_seen":1431970664345,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":222,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51229,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1431970634728,"flow_last_seen":1431970664345,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":222,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51229,"dst_port":40009,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":10,"flow_packet_id":16,"flow_first_seen":1431970634728,"flow_last_seen":1431970664345,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":91,"flow_tot_l4_payload_len":222,"flow_avg_l4_payload_len":13,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.28","src_port":51229,"dst_port":40009,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":16,"flow_first_seen":1431970655836,"flow_last_seen":1431970685642,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":90,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51246,"dst_port":40020,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":16,"flow_first_seen":1431970655836,"flow_last_seen":1431970685642,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":90,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51246,"dst_port":40020,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":97,"flow_packet_id":16,"flow_first_seen":1431970655836,"flow_last_seen":1431970685642,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":90,"flow_tot_l4_payload_len":201,"flow_avg_l4_payload_len":12,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"157.56.52.44","src_port":51246,"dst_port":40020,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00522{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":7,"flow_first_seen":1431970694308,"flow_last_seen":1431970701362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51303,"dst_port":62381,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00508{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":257,"flow_packet_id":7,"flow_first_seen":1431970694308,"flow_last_seen":1431970701362,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"80.121.84.93","src_port":51303,"dst_port":62381,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} @@ -2167,14 +2167,14 @@ 00512{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":239,"flow_packet_id":15,"flow_first_seen":1431970687670,"flow_last_seen":1431970700698,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":95,"flow_tot_l4_payload_len":260,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51288,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00522{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_first_seen":1431970691783,"flow_last_seen":1431970692055,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51300,"dst_port":20274,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} 00507{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":254,"flow_packet_id":3,"flow_first_seen":1431970691783,"flow_last_seen":1431970692055,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"76.167.161.6","src_port":51300,"dst_port":20274,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00540{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":6,"flow_first_seen":1431970685852,"flow_last_seen":1431970686318,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51284,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00546{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":6,"flow_first_seen":1431970685852,"flow_last_seen":1431970686318,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51284,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":232,"flow_packet_id":6,"flow_first_seen":1431970685852,"flow_last_seen":1431970686318,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":51,"flow_tot_l4_payload_len":51,"flow_avg_l4_payload_len":8,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51284,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00538{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":6,"flow_first_seen":1431970686319,"flow_last_seen":1431970686843,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51285,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":6,"flow_first_seen":1431970686319,"flow_last_seen":1431970686843,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51285,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00509{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":233,"flow_packet_id":6,"flow_first_seen":1431970686319,"flow_last_seen":1431970686843,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":5,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.218.125","src_port":51285,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00543{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":107,"flow_tot_l4_payload_len":107,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00549{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":107,"flow_tot_l4_payload_len":107,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00514{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":250,"flow_packet_id":6,"flow_first_seen":1431970690890,"flow_last_seen":1431970691584,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":107,"flow_tot_l4_payload_len":107,"flow_avg_l4_payload_len":17,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51296,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":2522,"flow_avg_l4_payload_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00551{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":2522,"flow_avg_l4_payload_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00517{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":251,"flow_packet_id":15,"flow_first_seen":1431970690890,"flow_last_seen":1431970705762,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":335,"flow_tot_l4_payload_len":2522,"flow_avg_l4_payload_len":168,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.24","src_port":51297,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00544{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00550{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00511{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test","flow_id":253,"flow_packet_id":11,"flow_first_seen":1431970691584,"flow_last_seen":1431970703178,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":5,"flow_tot_l4_payload_len":10,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.34","dst_ip":"91.190.216.125","src_port":51299,"dst_port":12350,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00138{"daemon_event_id":3,"daemon_event_name":"shutdown","thread_id":0,"packet_id":2146,"source":"skype_no_unknown.pcap","alias":"nDPId-test"} diff --git a/test/results/skype_udp.pcap.out b/test/results/skype_udp.pcap.out index ab02c4f0d..9f4294687 100644 --- a/test/results/skype_udp.pcap.out +++ b/test/results/skype_udp.pcap.out @@ -2,9 +2,9 @@ 00488{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":1,"flow_first_seen":1156534494734,"flow_last_seen":0,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":31,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00436{"flow_id":1,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534494,"pkt_ts_usec":734879,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"ABbjGScVAAR2lnvaCABFAAA7AABAAEARoZLAqAECGOC+lYyWmV4AJ5lYFpcCrtEAh3kuASsbNLlPtKfPLsSj70vZ59IfZD23vQ=="} 00437{"flow_id":1,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534496,"pkt_ts_usec":782355,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"ABbjGScVAAR2lnvaCABFAAA7AABAAEARoZLAqAECGOC+lYyWmV4AJ5lYFpcCqvCj5HkuAStybQoRs8uOXAH\/9ayvdzDWsfxVrg=="} -00512{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1156534494734,"flow_last_seen":1156534496782,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":62,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","ndpi": {"proto":"Skype","breed":"Acceptable"}} +00518{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":2,"flow_first_seen":1156534494734,"flow_last_seen":1156534496782,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":62,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable"}} 00437{"flow_id":1,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":3,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534500,"pkt_ts_usec":825691,"pkt_caplen":73,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":73,"pkt_l4_len":39,"pkt":"ABbjGScVAAR2lnvaCABFAAA7AABAAEARoZLAqAECGOC+lYyWmV4AJ5lYFpcCvuoUBXkuASuSYOIkRaPfGbxEfOnC\/51D4o9Ncw=="} -00538{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1156534494734,"flow_last_seen":1156534500825,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":93,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","ndpi": {"proto":"Skype","breed":"Acceptable","category":"VoIP"}} +00544{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":3,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":3,"flow_first_seen":1156534494734,"flow_last_seen":1156534500825,"flow_min_l4_payload_len":31,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":93,"flow_avg_l4_payload_len":31,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","ndpi": {"proto":"Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00417{"flow_id":1,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":4,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534567,"pkt_ts_usec":55540,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"ABbjGScVAAR2lnvaCABFAAAuAABAAEARoZ\/AqAECGOC+lYyWmV4AGplLsGsC8X+1b++522uzltBGo\/MQ"} 00417{"flow_id":1,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":5,"source":"skype_udp.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1156534567,"pkt_ts_usec":244697,"pkt_caplen":60,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":60,"pkt_l4_len":26,"pkt":"AAR2lnvaABbjGScVCABFAAAuy+IAAGUR8LwY4L6VwKgBAplejJYAGg6E4FcCztAyD8zMjQ7u\/eBiRTNa"} 00502{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":5,"source":"skype_udp.pcap","alias":"nDPId-test","flow_id":1,"flow_packet_id":5,"flow_first_seen":1156534494734,"flow_last_seen":1156534567244,"flow_min_l4_payload_len":18,"flow_max_l4_payload_len":31,"flow_tot_l4_payload_len":129,"flow_avg_l4_payload_len":25,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.2","dst_ip":"24.224.190.149","src_port":35990,"dst_port":39262,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} diff --git a/test/results/teams.pcap.out b/test/results/teams.pcap.out index bfcc00b13..c33b55bd8 100644 --- a/test/results/teams.pcap.out +++ b/test/results/teams.pcap.out @@ -185,7 +185,7 @@ 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":874,"source":"teams.pcap","alias":"nDPId-test","flow_id":18,"flow_packet_id":1,"flow_first_seen":1587041681745,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.70","src_port":60538,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":18,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":874,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":745719,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VHAqAEGNHJLRux6AbuCUaOxAAAAALAC\/\/8ErAAAAgQFtAEDAwUBAQgKMISsLQAAAAAEAgAA"} 00584{"flow_id":16,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":875,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":754842,"pkt_caplen":182,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":182,"pkt_l4_len":148,"pkt":"KDc3AG3IEBMx8Tl2CABFAACo\/M1AADkRwR\/AqAEBwKgBBgA1x1kAlAAAiC2BgAABAAMAAAAABmV1LWFwaQNhc20Fc2t5cGUDY29tAAABAAHADAAFAAEAAAb4ACQPYXNtLWFwaS1wcm9kLWV1DnRyYWZmaWNtYW5hZ2VyA25ldADAMgAFAAEAAAEsABoOd2V1MS1hcGktc2t5cGUIY2xvdWRhcHDAUcBiAAEAAQAAAAUABDRyS0U="} -00678{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":875,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681754,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":140,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype","breed":"Acceptable","category":"VoIP"},"dns": {"query":"eu-api.asm.skype.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.75.69"}} +00684{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":875,"source":"teams.pcap","alias":"nDPId-test","flow_id":16,"flow_packet_id":2,"flow_first_seen":1587041681714,"flow_last_seen":1587041681754,"flow_min_l4_payload_len":38,"flow_max_l4_payload_len":140,"flow_tot_l4_payload_len":178,"flow_avg_l4_payload_len":89,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":51033,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"dns": {"query":"eu-api.asm.skype.com","num_queries":1,"num_answers":3,"reply_code":0,"query_type":1,"rsp_type":1,"rsp_addr":"52.114.75.69"}} 00479{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":876,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":1,"flow_first_seen":1587041681755,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00441{"flow_id":19,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":876,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":755860,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+VLAqAEGNHJLRex7AbtPkLhOAAAAALAC\/\/8ixgAAAgQFtAEDAwUBAQgKMISsNwAAAAAEAgAA"} 00435{"flow_id":18,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":877,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":772449,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8MUxAAG0Gmwk0cktGwKgBBgG77HoxlVjpglGjsqASIACccwAAAgQFoAEDAwgEAggKVud31zCErC0="} @@ -195,7 +195,7 @@ 00435{"flow_id":19,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":880,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786454,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8PqJAAGwGjrQ0cktFwKgBBgG77HsaOOK2T5C4T6ASIABGlgAAAgQFoAEDAwgEAggKVN17aDCErDc="} 00423{"flow_id":19,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":881,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786551,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex7AbtPkLhPGjjit4AQEAmFKgAAAQEICjCErFNU3Xto"} 00714{"flow_id":19,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":882,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":786764,"pkt_caplen":277,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":277,"pkt_l4_len":243,"pkt":"EBMx8Tl2KDc3AG3ICABFAAEHAABAAEAG+IvAqAEGNHJLRex7AbtPkLhPGjjit4AYEAnBuAAAAQEICjCErFNU3XtoFgMBAM4BAADKAwNa\/jUh9W55wUB0tnlMq1eAEhrPfTr7oU\/DtVhV\/8e2AwAAHNrazKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACFGhoAAP8BAAEAAAAAGQAXAAAUZXUtYXBpLmFzbS5za3lwZS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjEACwACAQAACgAKAAgqKgAdABcAGAAbAAMCAAJ6egABAA=="} -00739{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1587041681755,"flow_last_seen":1587041681786,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":211,"flow_tot_l4_payload_len":211,"flow_avg_l4_payload_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}} +00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":882,"source":"teams.pcap","alias":"nDPId-test","flow_id":19,"flow_packet_id":4,"flow_first_seen":1587041681755,"flow_last_seen":1587041681786,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":211,"flow_tot_l4_payload_len":211,"flow_avg_l4_payload_len":52,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60539,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"ebf5e0e525258d7a8dcb54aa1564ecbd","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}} 02367{"flow_id":18,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":891,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802258,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU5AAG0GlW80cktGwKgBBgG77HoxlV6KglGklIAQBAXbeQAAAQEIClbnd\/MwhKxGsYFQCvPTWcgwCwYDVR0PBAQDAgSwMCgGA1UdEQQhMB+CHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIGsBgNVHR8EgaQwgaEwgZ6ggZuggZiGS2h0dHA6Ly9tc2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybIZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvY3JsL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNybDBNBgNVHSAERjBEMEIGCSsGAQQBgjcqATA1MDMGCCsGAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMwHwYDVR0jBBgwFoAUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQA2X\/om4H+4\/cR81+swhscxS+n0lRF6\/9QaS3UJkZbRbKTCin3OgcYqSG9pYg6G1+1K1UtTBpsolwlA3Wj42xE7Uv4QpgEXC5f0oaTcFK1me59SUtzp5qGDrwX6WjG8Ktb6uYB5gEczE7C4PC+CFPM3paTb5H5cy9SB3sXBctpW9JL3Q4jgLf0RmKI+tU\/yzqXGVuQXEGhEGBnx2gx7c5jv9zuJnDG+h+fy0tJ8oKxrnU3\/YDtE5a8Gc9riCos64k1IwawJ2ex5sg6EIN6aZMm7jlbnY0GaYkT3Xzq9y\/pq48vIUbUNujVUDc5\/R\/SCSk\/dzf6G7\/xO1H5cZnPEC40ThKUvhXFO2qUKIhsUCjzJG5EdSNtcUv8eCyVsfCMB7dRsifQSwSDmGmM4n\/G81i0O9M4b2XZ+YaSEgJZmQx7Uh5AdoOqwYq2SqBhAihGJdwH2XMq283yNTDRqqo\/WVv2tQAJnjORm59j1r8dDWyuUfRzmyA\/balmQRC8\/yMgQswTFwP1y97tt4lyNjydBDOIBJv2TudKgtjqTbU59+fWu1pBkJP0+oPi5U7f32J4ZwXrKLU9tbuRaGYpYaW\/H8\/s8ycG4tlrTfTYH+M+FW9Y1DTTSC08bOYNW3zgFB64XvsPWTwevXfQWad0gfn6zMKIffJ0Woh7B4kndlMdWD8PoFQAFuDCCBbQwggScoAMCAQICEAiIzVJfGSRETRSlgpHeuVIwDQYJKoZIhvcNAQELBQAwWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9yZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVyVHJ1c3QgUm9vdDAeFw0xNjA1MjAxMjUzMDNaFw0yNDA1MjAxMjUzMDNaMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJrfgVw7j67peZa5mnmngfI52lUoRiMCxYJmB7YV3v2cOhqbkQnSZo8LiRf4cYchfzjTP5olALc10Kv4CHo281Bb3yspJ96k3SSS+vTGcI02KprwgN41+h5CnQmBqtUHChalxVpCbUK+HkKCtFcwmVtFK9SP0woGxnOTpOGD78W\/BSeneM2zC+CeIhbzmNymFOjMlNcj+dBQmbu1CxCV8d8C6Y+OnVaZPNiP01j7XJJ+PXv4"} 02367{"flow_id":18,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":892,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802287,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU1AAG0GlXA0cktGwKgBBgG77HoxlVjqglGklIAQBAUZCwAAAQEIClbnd\/MwhKxGFgMDF2cCAABVAwNemFWRvAfOxj\/O2LS1GvKbLbSBGZz8VXg6KCdxioXd2iDMPAAAuPt+tyjvNYKaxBUbB7raSosgkzWm+0YaVQadbMAwAAANAAUAAAAXAAD\/AQABAAsADooADocACMkwggjFMIIGraADAgECAhMtAAND9wESkm\/sd3ORAAAAA0P3MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xODA2MTIxMTUyNDVaFw0yMDA2MTIxMTUyNDVaMCgxJjAkBgNVBAMMHSouYXN5bmNndy50ZWFtcy5taWNyb3NvZnQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9uZE6YVmzh1ro\/4d8Zo+mVIUEDaUviyuYUeJe2UcdHKsHDSUdTQ273GJngjGhgUHAMwvq9w4DIyOUBwcveTFYCZWzVANdRsFsD39nLpXp3vseB5VUXnmXJq29gPKyJFpkrbimMnnEOki7t5nlA9Z2K+wtT1X+Z4mAoJsSkScanGPxLU8tNcdirpZ0\/tvH70adSNM5iFxsRFLblVIdVrqSBeeNgafOdZlIIGOv9P0ABMY7kxYKnw7S8oGlbB3U6ETluGBbgY1c8n6n6\/5011R8Q390xb8uiX78WpVL6NRdD2McwEdmJZUS5ppX\/9INS5YdaB\/lVrmNtlNRMwIco6t6QIDAQABo4IEgjCCBH4wggH1BgorBgEEAdZ5AgQCBIIB5QSCAeEB3wB3AO5Lvbd1zmC64UJpH6vhnmajD35fsHLYgwDEe4l6qP3LAAABY\/PgldcAAAQDAEgwRgIhAK4F5+xyAZ8PgWPavtk6ktZ1Mdq5zCcDAj1dU28RQakyAiEA4DkHuRE6HiTW8RE5rf\/suuvGjdxWguIuLXIbKDGvcIwAdQBVgdTCFpA2AUrqC5tXPFPwwOQ4eHAlCBcvo6odBxPTDAAAAWPz4JSyAAAEAwBGMEQCIEUKuHHg1cOu3ulDL23MIyS7vGphefBcWA43AQQTjyDEAiAwpImJzpyITltxVu+5E9RI6mCB4HmB+34SpNIgXnX3UQB1AG9Tdqwx8DEZ2JkApFEV\/3cVHBHZAsEAKQaNsgiaN9kTAAABY\/Pgk\/MAAAQDAEYwRAIgVkQLEK+aFME4Hb3costoQAwcLpeeMRkWlMpAVlvVKYwCIFBaS7ZLwxVX5ANaQxIs20s7ccOU9sO75sNDOPFjUiVzAHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFj8+CXzAAABAMARzBFAiBcPX96Y\/KYUQsVX6QdJU7x5hxNzu6nSgTjsrM4Wi0KDwIhANsnPYmqBlSVUmPKVKXLbePowV4E\/X0udEs\/42bFhpbcMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPgYJKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYTS30KC55N6AgFkAgEdMIGFBggrBgEFBQcBAQR5MHcwUQYIKwYBBQUHMAKGRWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMElUJTIwVExTJTIwQ0ElMjA1LmNydDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AubXNvY3NwLmNvbTAdBgNVHQ4EFgQUC8G3iHj\/iQZjMtUq"} 02380{"flow_id":18,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":893,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041681,"pkt_ts_usec":802295,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUMU9AAG0GlW40cktGwKgBBgG77HoxlWQqglGklIAQBAUxzQAAAQEIClbnd\/MwhKxGUEla9xB7d\/jmSpBKVVLelK10CaBkVyzNB5CfFq2Vw9EGuvHvbAW1BKyp3Bsxmw4tGZUET95my601cq8ZggiyFDoWX7A8m9uNDLAC1iYf6BVxxO\/5YzlDjOnCki6hwqAwJQ6WJ1+eoyuC1hC9PBkepof+VSE6XEH8AZjML5L\/Zji0uGacDxJoS0qshrtemP+eppxTbDMRpNCuUkfXi4\/xlqy5KZqPLPGtZBjDJrsAZN5QcMC77MZrrtOg78DxXA3yzHpZ2hgzL1kQrWcULF8iQ0pE4ejd4OdVFk4J7wNMDEhQWvAD347vY8pbZ4dDQCwGth8PPlPAZj\/XFBXmCGKYSH6D5ae1XVEtVC1h\/TRd1LeAzdJ9zrEkO\/OXbGwT3ooXyYr1SJVC9xKQ4xAX9qEAxTYqZZGeBexCLlq4mRv\/1E61+mZV2YOOvwgpjfoLAgMBAAGjggFCMIIBPjAdBgNVHQ4EFgQUCP4ln3TqhwTCvLuOqDhfM8bRbGUwHwYDVR0jBBgwFoAU5Z1ZMIJHWMys+ghUNoZ7OrUETfAwEgYDVR0TAQH\/BAgwBgEB\/wIBADAOBgNVHQ8BAf8EBAMCAYYwJwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDCTA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzANBgkqhkiG9w0BAQsFAAOCAQEAPvLPMKV6vx5q3zlYGCg8w53u54HFS\/xn9r8fTjfa3vCv7or5A3tgZ3THO9r\/K0rr\/VR1E4vlwoESulISILopijrNQyTM1RcF\/pwWP3PgbUHAdj3yq0jFWWJkukRPChiCP0HqPxg6WOegMFd19dFqMRS2lJll2rboAd7kq\/u18+UZChhfpAJX3rZcJm9z\/i4J9QhDxA\/HJH+dKGdlodxb8Dr9+HCF56VPJN5CPx1EO12FBoUdHhzU2U5R5P0eERbMngDZlxqX42XHhjUbU3a+MtEsQUlLoz6TDFt3VwcwPDWLjNFpoif6VeirnRAe0RffumyJ08lb1wuUiKnYtJXXjhYABysBAAcnMIIHIwoBAKCCBxwwggcYBgkrBgEFBQcwAQEEggcJMIIHBTCBx6IWBBQodwHOZZ6LuFUo+CvPI9\/FvHYaTBgPMjAyMDA0MTUyMTU3NDhaMIGbMIGYMEwwCQYFKw4DAhoFAAQUKYX8YT2+L7ASD15CDkyew9We\/XwEFAj+JZ906ocEwry7jqg4XzPG0WxlAhMtAAND9wESkm\/sd3ORAAAAA0P3gAAYDzIwMjAwNDE1MjE1NzQ4WqARGA8yMDIwMDQxOTIxNTc0OFqhIjAgMB4GCSsGAQUFBzABBgQRGA8yMDE5MDQxNjIxNTc0OFowDQYJKoZIhvcNAQELBQADggEBAIqBVwyEEXU6DdYDkoqozQrVQ3FRKIupPdre3a2OvDuPW67S6m+tIdeZ+Zw9LPj+fsyi8jf2W8ZWZc4ClcyDblg9\/4QFNtwVQXl\/inU56UYBHMz0qJ+TlvszBwql1\/mJBV01cH5ActofnFMnyNGINyReu+UvHJO6dh1AH4X4rEowHHpl+4s\/zexMBK1xfIDEwT\/2vFdefuv46V0LNIY8NDUYTnWXdDZPMP9v2chYYDkVgXP0Tvyu\/anOPVEkkZ\/uySkMtjbbQW5NAC934A6s58ZNbyf\/qkweMbyXW5vDLaf7E\/7QvopkhMOF\/1Jz"} @@ -229,7 +229,7 @@ 00435{"flow_id":21,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":937,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108320,"pkt_caplen":74,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":74,"pkt_l4_len":40,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA8CPlAAG0Gw100cktFwKgBBgG77H37toO1hXm5XaASIACQKwAAAgQFoAEDAwgEAggKVQ929DCErW0="} 00423{"flow_id":21,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":938,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108400,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebld+7aDtoAQEAnOvQAAAQEICjCErYtVD3b0"} 00715{"flow_id":21,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":939,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":108566,"pkt_caplen":281,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":281,"pkt_l4_len":247,"pkt":"EBMx8Tl2KDc3AG3ICABFAAELAABAAEAG+IfAqAEGNHJLRex9AbuFebld+7aDtoAYEAl5vQAAAQEICjCErYtVD3b0FgMBANIBAADOAwNRm85ZKo2j5rIUIlemfdLsNPrk0mWhHKlhPOh2TLU7CwAAHKqqzKnMqMArwC\/ALMAwwBPAFACcAJ0ALwA1AAoBAACJ6uoAAP8BAAEAAAAAGQAXAAAUZXUtYXBpLmFzbS5za3lwZS5jb20AFwAAACMAAAANABQAEgQDCAQEAQUDCAUFAQgGBgECAQAFAAUBAAAAAAASAAAAEAAOAAwCaDIIaHR0cC8xLjF1UAAAAAsAAgEAAAoACgAI+voAHQAXABgAGwADAgACmpoAAQA="} -00739{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":939,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1587041682077,"flow_last_seen":1587041682108,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":215,"flow_tot_l4_payload_len":215,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}} +00745{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":939,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":4,"flow_first_seen":1587041682077,"flow_last_seen":1587041682108,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":215,"flow_tot_l4_payload_len":215,"flow_avg_l4_payload_len":53,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL","alpn":"h2,http\/1.1"}} 00481{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1587041682129,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00452{"flow_id":22,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":129643,"pkt_caplen":86,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":86,"pkt_l4_len":52,"pkt":"EBMx8Tl2KDc3AG3ICABFAABIVE8AAP8R4\/3AqAEGwKgBAcFqADUANJ5TmvIBAAABAAAAAAAABmNvbmZpZwV0ZWFtcwltaWNyb3NvZnQDY29tAAABAAE="} 00660{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":948,"source":"teams.pcap","alias":"nDPId-test","flow_id":22,"flow_packet_id":1,"flow_first_seen":1587041682129,"flow_last_seen":0,"flow_min_l4_payload_len":44,"flow_max_l4_payload_len":44,"flow_tot_l4_payload_len":44,"flow_avg_l4_payload_len":44,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":49514,"dst_port":53,"l4_proto":"udp","ndpi": {"proto":"DNS.Teams","breed":"Safe","category":"Collaborative"},"dns": {"query":"config.teams.microsoft.com","num_queries":0,"num_answers":0,"reply_code":0,"query_type":1,"rsp_type":0,"rsp_addr":"0.0.0.0"}} @@ -248,7 +248,7 @@ 02374{"flow_id":21,"flow_packet_id":8,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":967,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140679,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCPxAAG0GvcI0cktFwKgBBgG77H37to72hXm6NIAQBAXTOAAAAQEIClUPdxEwhK2LjSsxwxRzId3jeGOcUYa1okhJwHkIFUMAK5m4S+DHVwdsxLmmVC0BU\/Kj8qTM2cFU84jN5EwT04ozIVitGL++OYFwOWk3+FukY+8JB9+HGmLHmgjF0R1eYnYB3WnmOLtEsC1NOsYugOBgclvyzOaOXDohHl2wOSu96hPLlsu2anSMjrwOEJ8bpUBBj5FcdqcO8ao6h7cMd99xai8oYUItkA9yBatn4MF7y5xAmsQKCESMfD26qQ4esdkivR9fQWpzVPZm4qD5pjne0nfzaQS\/t7s8xJP\/cgQctTadaH\/f+jlPsvaPuRz\/re0OFQjjhnzySEl3lxb2\/QD2T6Zeb+c5wFFlPeuxlzDs6p5z\/B4soN+Lz3NftQ4GQhcmlezYqSfQ0GWUXOI\/yigppSD0yN1dtP\/m3QIDAQABo4IBQjCCAT4wHQYDVR0OBBYEFFiIn9bcnEgitxQ+\/4SI6OaF\/\/p9MB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoIVDaGezq1BE3wMBIGA1UdEwEB\/wQIMAYBAf8CAQAwDgYDVR0PAQH\/BAQDAgGGMCcGA1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwkwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL09tbmlyb290MjAyNS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDQYJKoZIhvcNAQELBQADggEBADCaxp1q\/e+TCAy+gnf5dqBtnnswI3uoKVr0aj7HCwyW37hLUuQNnDjteGO1c8AcHzvgp\/9\/SVGVMrjQm6nlz5YDgYDVSmEY\/sRqxt9\/QUYinIBm6w9CoOTzpCGjmNB6dPaM6MPSK6orzhFZGUTnXAcJQuvX\/RVNuW9sRDUmh7qjO2iwgecgyX8TAvPMq58clVDLrmSAu4cKXc6ma7J94z024ilRtyX80AnjsK3EYi4+foUmsvav920xc8YZmKlykwLOygs9POzZcOiA9RareGqHTcaBN6gKdoEGqO8XYHxwEBM8ONczTOQ3ZQj7kbPoFnZhKmX1WJSzRQHvwE8De7gWAAcrAQAHJzCCByMKAQCgggccMIIHGAYJKwYBBQUHMAEBBIIHCTCCBwUwgceiFgQUqShwURmVA+Jp3zLm2A+QCVyZqYAYDzIwMjAwNDE1MTkzMzA5WjCBmzCBmDBMMAkGBSsOAwIaBQAEFE8LW9m32q+ftvNjciJ21uGVriYpBBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fQITewAE4Lxi6ctlZLvhngAAAATgvIAAGA8yMDIwMDQxNTE5MzMwOVqgERgPMjAyMDA0MTkxOTMzMDlaoSIwIDAeBgkrBgEFBQcwAQYEERgPMjAxOTA0MTYxOTMzMDlaMA0GCSqGSIb3DQEBCwUAA4IBAQBJ3b+j9b9amWJnAoiCkmf2UNIwgNLUYY7i2oIxOcCe4FwtfKqAknYBXLXDmybtzIEQGc9zVWPgZbClw+Dn6abFkbXSG0mhM4QP5D5MQbVxhe7SgYoYVGwkJbmRpd4grc+7uBTiXMgAxBCB5kUsxvRwqLqgwU4Ain2W6hQNvDRMAvojfSg3lYkOFvlf7bcTwOK90BIJGU11EABEc5brrKndHE9hje0klAXbzMZTL8AqrbgnzOZi1rf+0+Wq4RUDesXv6I1AJt7EoKj704jMo9fFhVZPD8osr0ZocAW0OSf5m2CQ\/UMENY99jq5D1K0ZM\/O3ik40uY\/GyUUQa5PIKgTroIIFIzCC"} 02368{"flow_id":21,"flow_packet_id":9,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":968,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140795,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUCP1AAG0GvcE0cktFwKgBBgG77H37tpSWhXm6NIAQBAUnjQAAAQEIClUPdxEwhK2LBR8wggUbMIIDA6ADAgECAhNhABSap66sLDo2qRdOAAAAFJqnMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgMTAeFw0yMDA0MDIxNzEzMzNaFw0yMTA0MDIxNzEzMzNaMCsxKTAnBgNVBAMMIE1pY3Jvc29mdF9JVF9UTFNfQ0FfMV9LZXlCaW5kaW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1maDM3NHgdAGgJqybRrmWKqSKKEAYvfdrTYPfOpI9FRrz1yFR14GS0e4UDB2rKDlnKsuo9ERf\/Qqpm4JL8SvL0pujmn6ZoeGzO2t5TqMTECkWob1tiLQA1JYOA8RRLKv\/6QsvJzMX0qMbFHNBo4sgrAXoMuWjZcqWxH4fyrsBZdgc0mwpuoYVkD1vOmNWzPZMimjQN4cSMkWQA18afJyhp3Zot3K0OwDCe+wWTKimBMVYuYulSV22tyMOegkWJc5sufvpl383UKGyEuZphpcLBxNnCardIA\/ZTccdHp9K8sF+mKwepxetf1cMDzSEN\/\/lScMw9vnX9v5H8JjKrjnwIDAQABo4HWMIHTMB0GA1UdDgQWBBSpKHBRGZUD4mnfMubYD5AJXJmpgDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwkwDwYJKwYBBQUHMAEFBAIFADAfBgNVHSMEGDAWgBRYiJ\/W3JxIIrcUPv+EiOjmhf\/6fTA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdgcybR4HI6RYCAWQCAQcwGwYJKwYBBAGCNxUKBA4wDDAKBggrBgEFBQcDCTANBgkqhkiG9w0BAQsFAAOCAgEAgtIw1XGBca6Erz1OvszgvoWacr5GZbPwH0ImFUkqlkKLrDGX26dw78f6py5VurHJyseUPcKNiqot0YVSXUymap0K7zktMxei7OfRzxrEOStMFRhf4eEHV\/O7\/AyBR9FkstJwucamtnpDISZxXPW9rr05PkrOTdnlVyrAOCoYfaDnEQ+1xPoitDay0pVcsGYu77BrbIohKzTwrNEliVrRyxHwimvvaHfJEeI73Qw0xrKz5P2CAjjq+NS3oq42ShzO\/ZCeXkJIIQxSItMiM\/KixA61UUs2f5UNuYZUE81ffd5fJNZDPejQ32czGjgspCbvyvnAED5O\/ZqaA7YQYaq3nSRcyP4y0KOHUNeWrapkqf2VGf9QXuHcfDAhUX30IdVSnvu\/CLNrMi1Rc\/CZt9f0sLen3IGaj7ifKeBfINsKUj7Utkgl6EdqdMZrfLLmiG6+Y3\/KPyWJtGfIZM3e6ZY5B2wRzMrYYSNTP1k2g+IB3vv\/TAkkF6yAhm3Pz+d\/Rl+lIDcAaXujGd1t6LMRqDJpYUmLJDdwfzEcDT63DedYHw5CsMOyixyuwnidRlHASQQC1dmeOqRbV0dQxUDR0kmGy1yLAB3YKRexpVCttjSYvsbYbEtKmpQHIQQ8GwjWv4W9qsYbbo7PJWc0DNh7tJ43lVbs0jzQ0ajpeayGRvxpIogMAAFJAwAXQQTQoJYD6g8ebuDYZ3TNfiyX7B1Telgu6tp3m42naMlYmauJOKphc\/89F+xdu1RR0YKKWJ0SE4nRHS0ZUXLkE6DcBAEBAEIZWso7nL8yIcjBEQboGQnS0F50lXsOAmMHksMjMesG+hWHJWLYFLv\/CyhQ509vz1h0"} 00712{"flow_id":21,"flow_packet_id":10,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":969,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140797,"pkt_caplen":276,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":276,"pkt_l4_len":242,"pkt":"KDc3AG3IEBMx8Tl2CABFAAEGCP5AAG0Gwo40cktFwKgBBgG77H37tpo2hXm6NIAYBAVDcgAAAQEIClUPdxEwhK2LSACSZiy6xhZBqFoHfuVJnWThOmXSvs5HXo3nkFTRLqH\/gFiVBrWHZPaugh5f71QBq9sKelJI+oDa8wSlJ5Wt4j3w9VFG\/sQznUFvp8oJAtwYO5QBk3182KbUZxp5sVVXJuFqmJZO+GuUdjnw1GCNdmlSgjR1DoejFE\/6m13ilnZhP9wECEUStxbPasnxIc6wJ5KLpnMUvRkvrC2VBa49EtHON6Sd\/jJ4oOhG9BR2vDdkKCsdYc9u6\/DazX8JYXbReumcyu1TD8JRN0Vbg2sOAAAA"} -01050{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":969,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":10,"flow_first_seen":1587041682077,"flow_last_seen":1587041682140,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":6185,"flow_avg_l4_payload_len":618,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","server_names":"*.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=*.asm.skype.com","alpn":"h2,http\/1.1","fingerprint":"B9:41:1D:AE:56:09:68:D2:07:D0:69:E1:68:00:08:2B:EF:63:1E:48"}} +01056{"flow_event_id":6,"flow_event_name":"detection-update","thread_id":0,"packet_id":969,"source":"teams.pcap","alias":"nDPId-test","flow_id":21,"flow_packet_id":10,"flow_first_seen":1587041682077,"flow_last_seen":1587041682140,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1440,"flow_tot_l4_payload_len":6185,"flow_avg_l4_payload_len":618,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.75.69","src_port":60541,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"eu-api.asm.skype.com","server_names":"*.asm.skype.com","ja3":"74d5fa154a7fc0a7c655d8eaa34b89bf","ja3s":"986571066668055ae9481cb84fda634a","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","issuerDN":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1","issuerDN":"CN=*.asm.skype.com","alpn":"h2,http\/1.1","fingerprint":"B9:41:1D:AE:56:09:68:D2:07:D0:69:E1:68:00:08:2B:EF:63:1E:48"}} 00424{"flow_id":21,"flow_packet_id":11,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":970,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140844,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7aaNoAQD1W34AAAAQEICjCErahVD3cR"} 00424{"flow_id":21,"flow_packet_id":12,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":971,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":140846,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"EBMx8Tl2KDc3AG3ICABFAAA0AABAAEAG+V7AqAEGNHJLRex9AbuFebo0+7abCIAQD063FQAAAQEICjCErahVD3cR"} 00598{"flow_id":20,"flow_packet_id":14,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":972,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":141039,"pkt_caplen":192,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":192,"pkt_l4_len":158,"pkt":"EBMx8Tl2KDc3AG3ICABFAACyAABAAEAG+N\/AqAEGNHJLRux8AbuMg\/fuHSSo44AYEABmRwAAAQEICjCErahWxwTAFgMDAEYQAABCQQTQQKZeyPBCj\/p5lAGVLYOFivnXhnGHV0uHxCWHexpxHH2i8efa+9lnmebcwDiKsHG1Pc4CMMYS+KXQfwpjzBJWFAMDAAEBFgMDACgAAAAAAAAAADS8+dm2+8m4Tn34wvGsEBUoapDp6JZWBjkwDD4HPrC3"} @@ -286,9 +286,9 @@ 00480{"flow_event_id":1,"flow_event_name":"new","thread_id":0,"packet_id":1124,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00442{"flow_id":26,"flow_packet_id":1,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":1124,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041682,"pkt_ts_usec":376166,"pkt_caplen":78,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":78,"pkt_l4_len":44,"pkt":"EBMx8Tl2KDc3AG3ICABFAABAAABAAEAG+GfAqAEGNHJMMOyAAbuusi7sAAAAALAC\/\/9JyAAAAgQFtAEDAwUBAQgKMISuhQAAAAAEAgAA"} 00484{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":13,"flow_packet_id":1,"flow_first_seen":1587041680216,"flow_last_seen":0,"flow_min_l4_payload_len":355,"flow_max_l4_payload_len":355,"flow_tot_l4_payload_len":355,"flow_avg_l4_payload_len":355,"midstream":0,"l3_proto":"ip4","src_ip":"0.0.0.0","dst_ip":"255.255.255.255","src_port":68,"dst_port":67,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":25,"flow_packet_id":1,"flow_first_seen":1587041682369,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.33","src_port":60543,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} -00513{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"}} +00519{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","ndpi": {"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00481{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":26,"flow_packet_id":1,"flow_first_seen":1587041682376,"flow_last_seen":0,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":0,"flow_tot_l4_payload_len":0,"flow_avg_l4_payload_len":0,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.76.48","src_port":60544,"dst_port":443,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00494{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":11,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"255.255.255.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00492{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":1153,"source":"teams.pcap","alias":"nDPId-test","flow_id":12,"flow_packet_id":1,"flow_first_seen":1587041679280,"flow_last_seen":0,"flow_min_l4_payload_len":485,"flow_max_l4_payload_len":485,"flow_tot_l4_payload_len":485,"flow_avg_l4_payload_len":485,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.255","src_port":17500,"dst_port":17500,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} @@ -868,11 +868,11 @@ 00427{"flow_id":74,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2564,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869354,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0nZxAAGwGgG40cvqYwKgBBgG7w17cXACa3TTJGIAS\/\/81\/QAAAgQFoAEDAwgBAQQC"} 00408{"flow_id":74,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2565,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869423,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMkY3FwAm1AQIABWvAAA"} 00644{"flow_id":74,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2566,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":869663,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWAABAAEAGSWnAqAEGNHL6mMNeAbvdNMkY3FwAm1AYIACuOQAAFgMBAKkBAAClAwNemFWd9sBVDmqpQ1JOmTf85+s9vRwXDIKd7RSpfqD9hwAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAUAAAABMAEQAADjUyLjExNC4yNTAuMTUyAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"} -00770{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2566,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":4,"flow_first_seen":1587041693828,"flow_last_seen":1587041693869,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.152","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00776{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2566,"source":"teams.pcap","alias":"nDPId-test","flow_id":74,"flow_packet_id":4,"flow_first_seen":1587041693828,"flow_last_seen":1587041693869,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.152","src_port":50014,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.152","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 00426{"flow_id":75,"flow_packet_id":2,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2567,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893017,"pkt_caplen":66,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":66,"pkt_l4_len":32,"pkt":"KDc3AG3IEBMx8Tl2CABFAAA0NypAAGwG5t80cvqZwKgBBgG7w3QJhgXYjJLL5oAS\/\/9RUwAAAgQFoAEDAwgBAQQC"} 00408{"flow_id":75,"flow_packet_id":3,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2568,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893121,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShbAqAEGNHL6mcN0AbuMksvmCYYF2VAQIAByEgAA"} 00645{"flow_id":75,"flow_packet_id":4,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2569,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":893319,"pkt_caplen":228,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":228,"pkt_l4_len":194,"pkt":"EBMx8Tl2KDc3AG3ICABFAADWAABAAEAGSWjAqAEGNHL6mcN0AbuMksvmCYYF2VAYIAA4UQAAFgMBAKkBAAClAwNemFWd\/1XCA+79geTWEWiWwTsvTSnBi9NExcEsdrOoSgAALAD\/wCzAK8AkwCPACsAJwAjAMMAvwCjAJ8AUwBPAEgCdAJwAPQA8ADUALwAKAQAAUAAAABMAEQAADjUyLjExNC4yNTAuMTUzAAoACAAGABcAGAAZAAsAAgEAAA0AEgAQBAECAQUBBgEEAwIDBQMGAwAFAAUBAAAAAAASAAAAFwAA"} -00770{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2569,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":4,"flow_first_seen":1587041693849,"flow_last_seen":1587041693893,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.153","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} +00776{"flow_event_id":5,"flow_event_name":"detected","thread_id":0,"packet_id":2569,"source":"teams.pcap","alias":"nDPId-test","flow_id":75,"flow_packet_id":4,"flow_first_seen":1587041693849,"flow_last_seen":1587041693893,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":174,"flow_tot_l4_payload_len":174,"flow_avg_l4_payload_len":43,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.250.153","src_port":50036,"dst_port":443,"l4_proto":"tcp","ndpi": {"flow_risk": {"15":"TLS (probably) not carrying HTTPS"},"proto":"TLS.Skype_Teams","breed":"Acceptable","category":"VoIP"},"tls": {"version":"TLSv1.2","client_requested_server_name":"52.114.250.153","ja3":"e4d448cdfe06dc1243c1eb026c74ac9a","ja3s":"","unsafe_cipher":0,"cipher":"TLS_NULL_WITH_NULL_NULL"}} 02359{"flow_id":74,"flow_packet_id":5,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2576,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912361,"pkt_caplen":1506,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":1506,"pkt_l4_len":1472,"pkt":"KDc3AG3IEBMx8Tl2CABFAAXUnZ1AAGwGes00cvqYwKgBBgG7w17cXACb3TTJxlAQCARdzwAAFgMDF+kCAABVAwNemFWdM9zHzxbjC7QANdHz8AfaCDM7kl4CH3iC8m+C5SA8HQAAdg+4AWMXjI8CbVJCHoa9vuL+BAQY6d2I21i7H8AwAAANAAUAAAAXAAD\/AQABAAsADuwADukACSswggknMIIHD6ADAgECAhMtAAZemCjIP80XJ2CuAAAABl6YMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMRUwEwYDVQQLEwxNaWNyb3NvZnQgSVQxHjAcBgNVBAMTFU1pY3Jvc29mdCBJVCBUTFMgQ0EgNTAeFw0xOTA1MjQxNDEwMjZaFw0yMTA1MjQxNDEwMjZaMCExHzAdBgNVBAMTFnRyLnRlYW1zLm1pY3Jvc29mdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCLTNHPfgLoOgUfyR4c2CDg+CoBg7bwaQp6OOdTLjN80e6165bdZW8ryNWADQBv\/\/6Ld1H5eQQNetSDwVifHVU+CteBiHg6T9F1rA96B1Fk1nARcGhMPsZbgvGxJ+NR6ygkRK7GWC6KFZyOiZ0MvWyxQTJBlsBwklHTiX9D0fiSz06Q+tVkIHpWWHGkJRO+Tm3UUtCMr7e1K4eQloaVRg1AeMGEhZEaGXyKum9VwAP15maK0zwKMiUymx8uWFHW4J0+7wZd9kZyUeJvDO2QDZvxPl5w9NBzvGZUQFIkRD+XvUanlt9AtvhnDy5BiPzueeQgaJbyvyJl4Af8nIo8gppfAgMBAAGjggTrMIIE5zCCAfUGCisGAQQB1nkCBAIEggHlBIIB4QHfAHYA9lyUL9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAFq6jb0ngAABAMARzBFAiEA+SbPYnNZBq5NAa+KJuZcLJF6Cs7c51vg2wno92Y73cQCIFui0LePG9Yu0H+TqmpdeWJeVlJ0KiyWWMKI6D92L\/K3AHUAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAFq6jb1LQAABAMARjBEAiAZDnc3oPi8LaNBy6Df89WOlPch018jWvYNKaDO2U51nQIgYZuZffTHCtDDZ3lWVJgiVsjUCTGqki0p6MIBuSQoIfUAdwBc3EOS\/uarRUSxXprUVuYQN\/vV+kfcoXOUsl7m9scOygAAAWrqNvNaAAAEAwBIMEYCIQChq4nHPM4twtbxyAgrDLE3a797eV+6L2EiO6pBrFmrUAIhANBHWXnY9HAcs6WqVRp9r8q8wlaSY9pBfB7vJlbCShQPAHUARJRlLrDuzq\/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFq6jb0QQAABAMARjBEAiAzKKpy8ELEm5AO\/Cl8weRDML0CJ7IOPZ2GbRbx\/8vxWgIgDCW1c1pNKCE9DA2mbQwKGa4Z2H7dNtIRrzU4ZJcZOr8wJwYJKwYBBAGCNxUKBBowGDAKBggrBgEFBQcDAjAKBggrBgEFBQcDATA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiH2oZ1g+7ZAYLJhRuBtZ5hhfTrYIFdhNLfQoLnk3oCAWQCAR0wgYUGCCsGAQUFBwEBBHkwdzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9tc2NvcnAvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29jc3AuY29tMB0GA1UdDgQWBBSC313bBDWiwUMAeq0EgFmCSqbJVzALBgNVHQ8EBAMC"} 01144{"flow_id":74,"flow_packet_id":6,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2577,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912478,"pkt_caplen":602,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":602,"pkt_l4_len":568,"pkt":"KDc3AG3IEBMx8Tl2CABFAAJMnZ5AAGwGflQ0cvqYwKgBBgG7w17cXAZH3TTJxlAYCAT9qQAABLAwgZAGA1UdEQSBiDCBhYIWdHIudGVhbXMubWljcm9zb2Z0LmNvbYIYKi50ci50ZWFtcy5taWNyb3NvZnQuY29tghh0dXJuLnRlYW1zLm1pY3Jvc29mdC5jb22CGioudHVybi50ZWFtcy5taWNyb3NvZnQuY29tghsqLnJlbGF5LnRlYW1zLm1pY3Jvc29mdC5jb20wgawGA1UdHwSBpDCBoTCBnqCBm6CBmIZLaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JshklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwvTWljcm9zb2Z0JTIwSVQlMjBUTFMlMjBDQSUyMDUuY3JsME0GA1UdIARGMEQwQgYJKwYBBAGCNyoBMDUwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NwczAfBgNVHSMEGDAWgBQI\/iWfdOqHBMK8u46oOF8zxtFsZTAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBABCcisiO+DAS4OPnUkT5drdGW+ySCAd1BsW3Lp1Fdet9nBRcfBcsaKZ66uJsRxluxJrhagjZ4fh8tXKFj90="} 00408{"flow_id":74,"flow_packet_id":7,"packet_event_id":2,"packet_event_name":"packet-flow","thread_id":0,"packet_id":2578,"source":"teams.pcap","alias":"nDPId-test","pkt_oversize":false,"pkt_ts_sec":1587041693,"pkt_ts_usec":912518,"pkt_caplen":54,"pkt_type":2048,"pkt_l3_offset":14,"pkt_l4_offset":34,"pkt_len":54,"pkt_l4_len":20,"pkt":"EBMx8Tl2KDc3AG3ICABFAAAoAABAAEAGShfAqAEGNHL6mMNeAbvdNMnG3FwIa1AQH8FOfQAA"} @@ -1078,7 +1078,7 @@ 00504{"flow_event_id":2,"flow_event_name":"end","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":32,"flow_packet_id":20,"flow_first_seen":1587041682809,"flow_last_seen":1587041688190,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1226,"flow_tot_l4_payload_len":2932,"flow_avg_l4_payload_len":146,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60546,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00505{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":63,"flow_packet_id":17,"flow_first_seen":1587041692808,"flow_last_seen":1587041695538,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":1225,"flow_tot_l4_payload_len":4100,"flow_avg_l4_payload_len":241,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"167.99.215.164","src_port":60566,"dst_port":4434,"l4_proto":"tcp","flow_datalink":1,"flow_max_packets":15} 00498{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":33,"flow_packet_id":2,"flow_first_seen":1587041683142,"flow_last_seen":1587041683184,"flow_min_l4_payload_len":50,"flow_max_l4_payload_len":180,"flow_tot_l4_payload_len":230,"flow_avg_l4_payload_len":115,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57504,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} -00539{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1201,"flow_tot_l4_payload_len":12443,"flow_avg_l4_payload_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Skype","breed":"Acceptable","category":"VoIP"}} +00545{"flow_event_id":4,"flow_event_name":"guessed","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1201,"flow_tot_l4_payload_len":12443,"flow_avg_l4_payload_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","ndpi": {"proto":"STUN.Skype_Teams","breed":"Acceptable","category":"VoIP"}} 00506{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":64,"flow_packet_id":31,"flow_first_seen":1587041693428,"flow_last_seen":1587041697999,"flow_min_l4_payload_len":37,"flow_max_l4_payload_len":1201,"flow_tot_l4_payload_len":12443,"flow_avg_l4_payload_len":401,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"52.114.77.136","src_port":51681,"dst_port":3478,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00497{"flow_event_id":3,"flow_event_name":"idle","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":29,"flow_packet_id":2,"flow_first_seen":1587041682668,"flow_last_seen":1587041682697,"flow_min_l4_payload_len":58,"flow_max_l4_payload_len":139,"flow_tot_l4_payload_len":197,"flow_avg_l4_payload_len":98,"midstream":0,"l3_proto":"ip4","src_ip":"192.168.1.6","dst_ip":"192.168.1.1","src_port":57530,"dst_port":53,"l4_proto":"udp","flow_datalink":1,"flow_max_packets":15} 00514{"flow_event_id":7,"flow_event_name":"not-detected","thread_id":0,"packet_id":2817,"source":"teams.pcap","alias":"nDPId-test","flow_id":62,"flow_packet_id":4,"flow_first_seen":1587041692528,"flow_last_seen":1587041692578,"flow_min_l4_payload_len":0,"flow_max_l4_payload_len":120,"flow_tot_l4_payload_len":192,"flow_avg_l4_payload_len":48,"midstream":1,"l3_proto":"ip4","src_ip":"151.11.50.139","dst_ip":"192.168.1.6","src_port":2222,"dst_port":54750,"l4_proto":"tcp","ndpi": {"proto":"Unknown","breed":"Unrated"}} diff --git a/test/run_tests.sh b/test/run_tests.sh index 61d8b8547..f9612ba90 100755 --- a/test/run_tests.sh +++ b/test/run_tests.sh @@ -60,10 +60,11 @@ nc -h |& head -n1 | grep -qoE '^OpenBSD netcat' || { } nDPI_TEST_DIR="$(realpath "${nDPI_SOURCE_ROOT}/tests/pcap")" +cd "${nDPI_TEST_DIR}" cat <<EOF nDPId-test: ${nDPId_test_EXEC} -nDPI pcaps: ${nDPI_TEST_DIR} +nDPI pcaps: ${nDPI_TEST_DIR} ($(ls -l *.pcap *.pcapng *.cap | wc -l) total) -------------------------- -- nDPId PCAP diff tests -- @@ -71,7 +72,6 @@ nDPI pcaps: ${nDPI_TEST_DIR} EOF -cd "${nDPI_TEST_DIR}" mkdir -p /tmp/nDPId-test-stderr set +e TESTS_FAILED=0 @@ -82,14 +82,7 @@ if [ $? -ne 1 ]; then exit 7 fi -printf 'Using PCAP files from: %s (%s total)\n\n' "$(pwd)" "$(ls -l *.pcap *.pcapng *.cap | wc -l)" -for pcap_file in $(ls *.pcap *.pcapng *.cap); do - if file "${pcap_file}" | grep -qoE ':\s(pcap|pcap-ng) capture file'; then - true # pass - else - continue - fi - +for pcap_file in *.pcap *.pcapng *.cap; do printf '%s\n' "-- CMD: ${nDPId_test_EXEC} $(realpath "${pcap_file}")" \ >"/tmp/nDPId-test-stderr/${pcap_file}.out" printf '%s\n' "-- OUT: ${MYDIR}/results/${pcap_file}.out" \ @@ -192,7 +185,7 @@ netcat (OpenBSD) exec + args: ${NETCAT_EXEC} EOF cd "${MYDIR}" -for out_file in $(ls results/*.out); do +for out_file in results/*.out; do pcap_file="${nDPI_TEST_DIR}/$(basename ${out_file%.out})" if [ ! -r "${pcap_file}" ]; then printf "%-${LINE_SPACES}s\t%s\n" "$(basename ${pcap_file})" '[MISSING]' |